We are booking in new cases · Weekdays, 9am–5:30pm Urgent case? Call 0800 6890668
MHDR Maidenhead Data Recovery 0800 6890668 Send it in
MHDR / Media and kit we recover / NAS devices

Devices · network storage

NAS recovery in Maidenhead. It keeps serving files while it fails.

A NAS continues to function while it is failing. It continues to serve up your shares, and all files will remain mounted and accessible. So people will continue to use it until they notice something is wrong with it. At which point the NAS's web interface is likely going to prompt you to either rebuild, scrub, or repair it. However, at this point using any of these options will provide the best opportunity to lose the volume. The best course of action you can take is to shut down the NAS immediately, and allow it to stay turned off, then call us via telephone or fill out our online form to obtain a quote first. If possible, remove the disks from the NAS and label them with their respective bays. If removing the disks is not feasible, please send the entire NAS. In both scenarios it may be posted from Maidenhead to the Guildford intake lab, with tracking and insurance, or you can drop it off at the lab (Monday to Friday, 9am to 5:30pm, no appointment necessary).

Only pay if we recover your data, on most jobs Diagnosis free, then a fixed quote Get a quote, then post it in from Windsor, Slough or anywhere else

Describe the fault to an engineer
0800 6890668

NAS symptoms, and what each one means.

Nothing matches? Use the triage →
One bay blinking, the pool reported degradedA drive has failed and the remaining ones are compensating for it. Every hour you keep it running, the risk increases.Act soon
The rebuild halted, or the volume now reads 'crashed'There were unreadable sectors on a second drive causing it to fail. Leave it stopped and do not attempt to run the rebuild again.Act soon
The chassis is dead, the drives are fineThis is one of the more welcome arrivals; the array description is stored on the drives themselves instead of inside the box.Lab case
Shares vanished after a firmware updateThis occurs due to broken configurations or containers covering untouched data.Lab case
A PC wants to format the drives you connectedAs expected: Windows does not read any of these formats. Just decline and cease attempts.Lab case
If you wish to post it: first obtain a quote for your item via either of two methods: by telephone or by completing the online form. Then you can post the item to us using a tracked and fully insured postal service that will take it directly to our secure intake laboratory in Guildford. Alternatively, if you would rather drop it off at the Guildford laboratory personally, this is possible Monday to Friday, 9am to 5:30pm, and no appointment is needed; either way, we will cover the return postage costs. From a laptop, PC or Mac, send the drive on its own (storage soldered onto the circuit board, as in T2 and Apple silicon Macs or soldered laptop flash memory, is not taken on; if you're unsure which kind you have, please call us first). RAID drives require removal from their casing and labelling by bay number, and server disks will similarly need removing from the server and labelling by bay number. NAS disks need the same procedure if they can be removed; if not, send the entire NAS unit. An external drive must be posted whole, complete with its cable and power supply. If you wish to check the packaging before posting, an engineer will talk you through every item on the telephone. Every stage of this process is detailed on the posting page.

The NAS makes we see most on the bench.

SynologyDSM exists on DiskStation and RackStation systems, with an SHR stack that utilises either Btrfs or ext4 file systems.
QNAPTS and TVS products exist on QTS or QuTS platforms and are usually among the first products targeted during ransomware sweeps.
BuffaloThe E-number blinking units are the TeraStation and LinkStation.
Netgear & WDSmall boxes, big losses with ReadyNAS and My Cloud.

The words on screen, decoded.

A different fault? →
The symptomThe likely causeStart here
Synology: Volume CrashedLosses in disks exceed the redundancy of parityShut off the power before DSM starts repair work
Synology: Storage Pool DegradedA single drive is failing while a share remains activeEvery hour the unit stays on is time lost
QNAP: system volume not active / RAID unmountedNo way for the box to build itself a volumeBuild it somewhere else
DeadBolt — WARNING: Your files have been lockedRansomware: every file has ".deadbolt" added to each nameTake a picture of it; do not touch the power
Buffalo E14: Cannot mount the RAID arrayA TeraStation or LinkStation can't bring its array onlineIdentify the E number, and disconnect the power
Buffalo E16: The hard disk was not foundA member has failed; or, it's simply disappearedThe data almost always remains intact
Buffalo E30: The hard disk may be brokenThe unit has removed a member (it is now disconnected)Don't touch the rebuild process

What happens to your NAS between arrival and return.

The most recent cases →
01

Booked in, then assessed at no cost Free

Nothing is chargeable until you say yes. Every item gets a case number of its own immediately upon receipt, an engineer determines what has failed, and you get a clear picture of which files have a real possibility of being recovered. The single quote that follows is fixed, written down and does not cost anything.

Diagnosis at no costOne fixed quote, in writingNothing signed
02

Nothing starts before the copies do

Each individual disk will be fully cloned (difficult surfaces are also cloned), and every subsequent action will be performed against these clones. This means the enclosure itself should remain powered down as well, thus preventing whatever caused the problem from happening again.

Read-only images madeRebuilds ruled out
03

Unpick the layers

Most Synology volumes are made up of multiple components: equal-sized portions of different sized disks, which create an array for each portion of the disk(s). Those arrays are then held together by LVM. QNAP, Netgear and Buffalo use different methods of organising their systems but they generally follow similar procedures for creating tiers of storage. Each tier of storage is rebuilt through software, from bottom to top.

mdadm and LVM unpickedSHR slices back in sequence
04

Put the file system right

Once your storage system is rebuilt, our focus moves to what sits on it. Any damaged btrfs or ext4 volume needs to be repaired, and once the repair is complete, the shares and folders are restored with their own names. A comprehensive directory listing is then provided to you to check prior to completing the restoration.

btrfs or ext4 repairedShares under their own names
05

Opened, verified, and sent home

You don't get charged anything until you've confirmed and authorised that everything is fine after seeing the entire list of what was recovered. Any recovered items are returned via brand-new storage media and the postage costs for these are covered by us. We do not consider a project complete here until we receive confirmation that you have been able to successfully access and review every item you received back.

You approve the list firstReturned on fresh mediaThe return post is ours

What tends to show up first

  • There is nothing proprietary at the base of SHR: mdadm (RAID) arrays with LVM layered on top, constructed using equal portions of disk space which come from non-matching hard drives. The layers go back up in sequence via software, working from images and nowhere near the box. Whatever the Repair button does, it is not meant for this.
  • A "degraded" state has a deadline: repairing a RAID 5 or SHR will require every available disk to do a full read, and all of these disks were purchased at the same time and therefore are ageing at the same rate. Most likely, however, there is going to be one of the disks which does not finish.
  • The enclosure (box) is typically the least expensive component of a NAS: Buffalo and almost all other NAS manufacturers write the array configuration onto the members themselves. Therefore, if you find a dead power supply, this would be a relatively good thing to find in your NAS.
  • A ransomed NAS is proof in itself of what happened as soon as you are notified of an issue. Take a picture of the demand note immediately while it is visible on screen because once you hit "restart", the note may disappear and, most likely, so will the identification code associated with it. See our ransomware and forensics pages for information on how to proceed after this occurs.

In 2022, the point became clear: the DeadBolt campaign began sweeping around the world on 25 January 2022, reaching about 3,700 QNAP devices that were accessible via the public internet; later in the year additional waves were launched. Although eCh0raix and QLocker had been hitting the same targets previously, the single common thread to each sweep was the fact that all the devices being attacked were configured to be accessible via the internet and had not been updated with new firmware.

From the casebook, lately.

MH · MHD-2026-6785ON RECORD ✓

The rebuild that finished off a Wokingham mirror

The two red lights on their own were survivable; however, the subsequent attempt to rebuild was not, as it overwrote the box's own metadata. Each of the disks was successfully imaged, despite the presence of bad sectors within them. Once the images were obtained, both copies were compared to determine which one read more cleanly at each point. This process continued until each section of the mirrored volume was completely rebuilt.

100% recovered5 days from arrival

Before it comes to the lab.

Do these now

  • Switch off the unit as soon as "degraded" appears
  • Mark every disk (by its bay) before removal
  • Get a quote first, then post the disks, or the entire NAS if they will not come out
  • Tell us the model, and whether your volume is SHR or plain RAID

Things best not done

  • Start a rebuild (or try repair)
  • Run a data scrub on the degraded pool
  • Accept Windows' offer to initialise the disks
  • Move disks from one bay to another to prove a theory

The questions that arise most often.

The box has stopped working. Has the data gone with it?

Usually not. The member order, chunk size, and volume above are written on the disks; the chassis simply reads them back. A healthy set of disks within a dead box will result in predictable work.

Whole unit, or just the drives?

Only the disks, if they can be removed, each disk labelled with its bay. If removal is not possible, the entire NAS can go to the Guildford intake lab complete, with the drives remaining in their bays. Servers require the members only, each labelled with its bay, never the server itself. Obtain a quote first via phone or our online quote form. At our end, imaging will occur first regardless.

What makes SHR different from ordinary RAID?

The primary purpose for Synology to offer Hybrid RAID is to ensure wasted space from mismatched disks does not occur. SHR will partition all drives into equal sized portions, create separate RAID arrays using each matched set of portions and then join those RAID arrays together with Logical Volume Management (LVM) as a single volume. The recovery process consists of unstacking the created layers in order of creation.

The volume has read 'crashed' since the rebuild. Is that the end of it?

It is the enclosure that ultimately makes this 'crashed' determination, and not your data. Once each disk is imaged individually, the previously formed RAID/LVM configuration can be recreated in software, and a volume DSM had given up on typically comes back whole.

More of the jobs we've closed.

Servers & RAID sets → Buffalo NAS data recovery → Drives that travel with you → What goes wrong →

Switched off, it keeps every chance it has.

Every additional power-up asks for even more of a drive that is already starting to fail. First open a case with us, and let the free diagnosis tell you how much remains.

0800 6890668

Ask for a free diagnosis Posting it to us