Devices · network storage boxes
Most NAS failures are silent. Shares keep mounting, files keep opening, and a disk in bay three can lie dead for weeks with nobody noticing. The damage comes at the next step, when someone clicks yes to a scrub, a repair or a rebuild offered by DSM or QTS. Once that is done, the storage pool is gone. Turn off the box and leave it off. They come to us from a freight office at Millbay in Plymouth, a law practice in Tavistock and a fabrication company just outside Camborne.
You will be talking to an engineer
0800 6890668
| What turns up | What that points to | Where to start |
|---|---|---|
| Synology: Volume Crashed | More disks lost than the parity can carry | Power it off before DSM proposes anything |
| Synology: Storage Pool Degraded | A disk has dropped out; everything above it carries on regardless | Each hour it stays on costs something |
| QNAP: system volume not active; RAID unmounted | QTS made the volume and now cannot mount it | Assemble it away from the unit |
| DeadBolt — WARNING: Your files have been locked | Ransomware — every file now ends in .deadbolt | Photograph the message and alter nothing |
| Buffalo TeraStation, code E14: Cannot mount the RAID array | The RAID is fine, but the enclosure won't bring it online | Note the E-number, then pull the plug |
| Buffalo TeraStation, code E16: The hard disk was not found | Either the drive is dead or the enclosure has lost sight of it | Its contents are usually still there |
| Buffalo TeraStation, code E30: The hard disk may be broken | One disk has been ejected from the set | Turn the rebuild down |
Whatever is delivered is booked in using a unique reference (case number) on the date it arrives at the bench. The engineer will identify the actual fault at no charge. This gives a straightforward answer on what can be recovered from the drive and what cannot, plus one written quotation. There will be no further activity until you have read and accepted the quotation.
Each disk is copied in full on imaging hardware made for it, weak spots included. All later work is done on those images. Your enclosure stays switched off on our bench, so there is no chance of it resuming where it left off.
A NAS volume is hardly ever one thing. Synology uses paired partitions, then one md array per group, and finally LVM on top of everything. Buffalo, Netgear and QNAP each arrange it their own way. Each level is rebuilt in software, starting at the bottom.
Once the stack is back together, the btrfs or ext4 file system on it is repaired. Your shares come back under the names you gave them, with the folder structure as you left it. The complete listing goes to you to check, and nothing is signed off until you have.
Give yourself time to consider it. It costs you nothing. We list all of the files we recover for you before sending out an invoice, and we only ask for payment once you have authorised it. We also buy media specifically for your recovery and send it back to you, with the return postage paid by us. The case stays here on our bench until we have your confirmation that the files open properly on your own machine.
What 2022 taught: the first DeadBolt wave, on 25 January 2022, hit around 3,700 QNAP devices reachable from the internet, and further waves followed later that year. QLocker and eCh0raix had been through the same territory before it. Almost every victim shared two things: the device was reachable from outside, and it was still running the firmware it came with.
Two red lights were showing, and it was still possible to save the unit. What finished it was the rebuild someone started next, which wrote over the box's own metadata. Afterwards both disks were imaged, bad sectors included. The mirror was reassembled a block at a time, each block taken from whichever disk still read cleanly at that point, and the shared volume came back intact.
Rarely. Each disk holds its own information about the volume (the bay it sat in, the stripe size and every layer above it); the enclosure holds none of it. Sound disks in a dead enclosure are some of the least troublesome work we get.
Bare disks, if they come out. This is what the Bristol lab asks for. Get a quote first, then remove the disks one bay at a time and mark each disk with its bay number before packing. If the disks cannot be removed, send the entire NAS. Send it tracked and insured, or drop it off at the Bristol lab yourself, no appointment needed. No data is read until after imaging.
Synology Hybrid RAID lets disks of mixed capacity be used without wasting space. Each disk is divided into partitions sized to match partitions on other disks in the same set. An md array is built over each matching group, and LVM joins those arrays into the single volume you see. We take it apart a layer at a time, starting at the bottom.
No. Volume Crashed simply states what the box can no longer do. It says nothing about your data. Image each disk, rebuild the pool outside the box in software, and a volume DSM gave up on will generally read right through.
Diagnosis costs nothing. We give you a report listing which files can be read, which cannot, and what is needed to get them off. Do not connect the drive until then.