Devices · networked storage units
NAS failures are quiet. Shares continue to mount, files continue to open, and a NAS can sit with bay three failed for weeks before anybody notices. The problem is what happens next: DSM or QTS offers a scrub, a repair or a rebuild, somebody agrees, and the storage pool is gone. Turn the box off and leave it turned off. Ours come into the Oxford intake lab from a distribution office at Theale, a solicitor's office in Thatcham, a fabrication shop on the Woodley estates and a cupboard in a Caversham house. NAS and array work starts at £500 + VAT, and the look that decides it is free.
An engineer answers, and looking is free
0800 6890668
| What you are seeing | What is likely wrong | What happens next |
|---|---|---|
| Synology: Volume Crashed | More disks lost than the parity will support | Turn it off before DSM attempts to repair anything |
| Synology: Storage Pool Degraded | A disk has gone, but the layers above continue regardless | Every hour it stays powered costs you |
| QNAP: system volume inactive; RAID does not mount | The volume QTS created will no longer mount | Reassemble it away from the box |
| DeadBolt — WARNING: Your files have been locked | Ransomware: each file now carries a .deadbolt suffix | Photograph the message, change nothing |
| E14 on a Buffalo TeraStation: cannot mount the array | Everything is okay with the array, but the box can't bring it up | Jot the E-number down, then unplug |
| E16 on a Buffalo TeraStation: no hard disk found | Either you've got a bad disk in that box, or the box has lost sight of it | What was on it is usually still there |
| E30 on a Buffalo TeraStation: a disk it says may be faulty | One disk has been removed from the set | Decline the rebuild |
A case number is assigned to your device when we receive it. An engineer then finds the real fault (free) before anything else occurs; you will be advised clearly of what will be returned and what will not, along with a single written price. Charges cannot begin until you have read this and accepted.
Each disk is duplicated end to end on imaging equipment designed specifically for this work, weak areas included. All operations then run on the clones. If the box comes too, it is left turned off here, so it never resumes whatever it was doing.
One volume is typically several layers deep. On a Synology, the partitions are paired together, an md array is built over each pair, and LVM then presents the result. The other major manufacturers (QNAP, Netgear and Buffalo) have their own versions of the same idea. Every layer is reconstructed in software, working up from the disks.
When these layers are all up and running again, the btrfs or ext4 file system above them is repaired. Each share will appear with its original name and folder structure. Final sign-off only happens once the complete list of files has been sent to you to read.
You look at the file list first and make a decision about what to do. We will never invoice anything until you have said yes, and in most cases you only pay if we recover your data. All of the information that we recover will be put on new media purchased by us specifically for this job, and our company pays the cost of postage back to you. The case stays open on the bench until you tell us the files open on your own machine.
What we learned in 2022: on 25 January 2022, DeadBolt's first wave found nearly 5,000 QNAP boxes reachable from the internet, and the rest of the year brought further waves. eCh0raix and QLocker had hit the same ground before it. Everyone who lost data shared two things: a device reachable from outside, and firmware nobody had touched since it came out of the carton.
Two red lights, and the box could still be recovered at that point. The rebuild started after that is what did the damage, writing over the unit's own metadata. Both drives were then copied in full, weak sectors and all, and the mirror was rebuilt block by block, each block taken from whichever disk still read cleanly there. Every share opened as before.
Rarely. Each disk contains its own record of the volume: which bay it sat in, the stripe size, and every layer built above it. The box itself holds none of that, so sound disks inside a box that has failed are some of our easiest jobs.
If the drives are removable, label each one with its bay number before packing. If they won't come out of the NAS, send it all as it stands, including the power supply. Get a quote first and make sure the parcel is insured. No investigation of your files happens until there is a valid image of each drive.
SHR is Synology’s method of handling disks of different capacities. Rather than let the excess space go to waste, it breaks each disk into partitions that pair with equivalent partitions on the other drives, forms an md array around each pairing, and then lets LVM present the result as the single volume you see. Recovering it means identifying each of those layers and rebuilding them in order, starting with the partitions.
No. Volume Crashed tells you what the box can't do right now; it does not tell you anything about your data. Image every drive, rebuild the pool in software away from the box, and a volume DSM has stopped mounting will usually read straight through.
There is no charge for the look. You then receive a list of the files that opened, those that did not, and a fixed amount to complete the job. Keep it switched off until you have received that in writing.