Devices · network storage boxes
NAS failures are mostly silent ones. Shares keep mounting, files keep opening, and a disk can lie dead in bay three for weeks before anybody notices. The harm arrives at the following step: DSM or QTS proposes a scrub, a repair, a rebuild; somebody clicks yes; the pool is gone. Shut the box down and keep it down. They come to us from a freight office at Millbay in Plymouth, a solicitor's practice in Tavistock, a fabrication shop outside Camborne.
You will be talking to an engineer
0800 6890668
| What shows up | What that points to | What to do |
|---|---|---|
| Synology: Volume Crashed | More disks lost than the parity can carry | Power it off before DSM proposes anything |
| Synology: Storage Pool Degraded | A disk has dropped out; the layers above run on regardless | Each hour it stays on costs something |
| QNAP: system volume not active; RAID unmounted | QTS made the volume and now cannot mount it | Assemble it away from the unit |
| DeadBolt — WARNING: Your files have been locked | Ransomware — every file now ends in .deadbolt | Photograph the message and alter nothing |
| Buffalo TeraStation, code E14 — Cannot mount the RAID array | The array is fine; the enclosure will not bring it up | Note the E-number, then pull the plug |
| Buffalo TeraStation, code E16 — The hard disk was not found | Either the drive is dead or the enclosure has lost it | Its contents are usually still there |
| Buffalo TeraStation, code E30 — The hard disk may be broken | One disk has been ejected from the set | Turn the rebuild down |
Whatever arrives is booked in under a case number on the day it reaches the bench. An engineer then works out the actual fault, and that part is free. You get a plain answer on what can come off the drive and what cannot, followed by one price in writing. Nothing further happens until you have read it and agreed.
Every disk is copied in full on imaging hardware made for it, weak regions included. Thereafter every operation runs on those copies. Your enclosure stays switched off on our bench, so it never resumes where it stopped.
A NAS volume is hardly ever one thing. Synology layers paired partitions, then one md array per group, then LVM on top of everything. Buffalo, Netgear and QNAP each arrange it their own way. Every tier is reassembled in software, starting at the bottom.
When the stack is standing again, the btrfs or ext4 on it gets repaired. Shares return under the names you gave them, with the folder tree as you left it. The complete listing goes to you to check, and nothing is signed off until you have.
Thinking it over costs you nothing. Everything the drive gave up is listed for you before any invoice exists, and the bill only follows your go-ahead. Files travel back on media bought in for your job, with return carriage paid at this end, and the case stays on the bench until you confirm they open on your own computer.
What 2022 taught: the opening DeadBolt wave, on 25 January 2022, took in around 3,700 QNAP units reachable from the public internet, with more waves arriving later that year. QLocker and eCh0raix had been through the same territory before it. Almost every victim had two things in common: the box was reachable from outside, and its firmware was still whatever came in the carton.
Two red lights showing, and the unit could still have been saved. What finished it was the rebuild someone started next, which wrote over the box's own metadata. Afterwards both disks were imaged, bad sectors and all. The mirror was reassembled a block at a time, each block taken from whichever disk still read cleanly at that spot, and the shared volume came back whole.
Seldom. Each disk carries its own account of the volume — the bay it occupied, the stripe size, and every layer built on top. The chassis holds none of it. Sound disks inside a dead enclosure is some of the least troublesome work we get.
The drives only. Bare disks are what the Bristol lab asks for. Pull them one bay at a time and mark the bay number on each before packing. Send them fully insured, or bring them in yourself. Nothing is read for data before it has been imaged.
Synology Hybrid RAID exists so that mismatched disk sizes do not waste space. Every disk is divided into partitions sized to match counterparts elsewhere in the set. An md array is laid over each matching group, and LVM joins those arrays into the single volume presented to you. We take it apart a layer at a time, from the bottom up.
No. Volume Crashed states what the box can no longer do; it says nothing about the data. Take an image of each drive, rebuild the pool outside the box in software, and a volume DSM abandoned will generally read right through.
The diagnosis is free, and it comes back as a list: which files read, which do not, and what getting them off would take. Until then, leave the drive unplugged.