We are booking in new cases · Weekdays, 9am–5:30pm Urgent case? Call 0800 6890668
MHDR Maidenhead Data Recovery 0800 6890668 Send it in
MHDR / Specialist cases / Buffalo NAS recovery

Specialist work · Buffalo NAS

Buffalo NAS recovery, Maidenhead. EM mode is a symptom, not a verdict.

Buffalo signals trouble with a blink count and the letters EM, and neither indicates which layer failed: it may be the boot partition after a failed software update, a member of the array that has dropped out, or a data volume that will not mount. Remedies vary, and the wrong remedy would overwrite what you were looking for. Do not allow the unit to be powered up again until the disks have been imaged, and decline all offers to restore or reinitialise before then. First get a quote by telephone or using our quote request form. Then post the disks from Maidenhead, tracked and insured, to the Guildford intake laboratory, each disk labelled by its bay number. Alternatively, you may drop the disks off at the Guildford intake laboratory yourself (Monday to Friday, 9am to 5:30pm, no appointment needed). If the disks will not come out, the NAS can travel complete, with the disks remaining in their bays.

Only pay if we recover your data, on most jobs Diagnosis free, then a fixed quote Get a quote, then post it in from Windsor, Slough or anywhere else

Describe the fault to an engineer
0800 6890668

Buffalo NAS symptoms, and what each one means.

None of these? Run the triage →
The symptomThe likely causeStart here
The LEDs are blinking a failure indication.Three possible causes for one failure code: array failure, disk failure or firmware failure.Turn it off immediately; record how many times the light blinks.
On the console, the array is showing as degraded.A member of the array has gone away. There is nothing to replace it so the system continues without any redundancy.Time is working against you at this point.
The LinkStation appears to be dead.The casing contains nothing; your shares reside on the disks inside of it.This is one of the better outcomes
The firmware has been updated and the unit will not start again.The boot partition was damaged, not the data partition.Do not accept the reinitialise prompt.
Windows is offering to format the disks.Expectedly, Windows can't read either an XFS or ext4 file system.Don't accept it.
The shares have all been cleared, with a ransom note left behind for you to find.A campaign that searches for NAS boxes still connected to the Internet.Take a picture of the note; pull the plug; then visit the ransomware page.
Where to send it: first get a quote, by phone or with the form, then send it using a tracked, insured service to the Guildford intake laboratory, or drop it off there yourself (Monday to Friday, 9am to 5:30pm, no appointment needed). We will cover the cost of the postage back to you. From a laptop, PC or Mac, we just require the drive out of your computer; storage soldered to the board (T2 and Apple silicon Macs, soldered laptop flash) is not taken on, and if you're unsure as to type, call us first. From a server or RAID set, just send the individual drives, all clearly labelled by bay. From a NAS, send the disks, each labelled by bay, if they come out; otherwise, send the entire NAS unit. A single external drive comes whole, with its cable and power supply. If you wish to review your packaging before posting, contact an engineer who will walk you through the process over the phone. All steps involved with the postage process are listed on the postage page.

Why a Linux PC will not mount Buffalo NAS disks.

Its own metadataBuffalo describes its arrays using its own format (and nothing like a plain old Linux superblock). Remove the drives from the NAS box, place them into a workstation, and your workstation will tell you there are partitions on those drives that it won't assemble, and this is probably why they rarely work when moved over to a Linux machine.
XFS on the old, ext4 on the newEarlier models of the LinkStation and TeraStation were built with XFS, while newer versions have shifted over to ext4. Once the array is assembled, both types will show up again. However, they work differently from each other (the tools available and the ways they fail), so it's good to know what format your volumes are as soon as possible.
What EM mode is telling youEmergency mode is when your device says its firmware cannot boot. This has no bearing on the status of your data partition and this is in no way diagnostic. Counting the blinking lights can narrow down the area where something went wrong, but the disks still need to be read to determine what is indeed wrong.
Two things we never runThere are two things to consider here. First, there is the firmware's own recovery procedure, which can reinitialise an array while it is supposed to be fixing it. Second, there are file system repair utilities run directly on the original disks. Neither of these is going to be used in this process. Everything we do in this process will take place using read-only access to the disk images.

What happens between arrival and return.

01

Booked in, then assessed at no cost Free

Nothing is chargeable until you say yes. Every item gets a case number of its own immediately upon receipt, an engineer determines what has failed, and you get a clear picture of which files have a real possibility of being recovered. The single quote that follows is fixed, written down and does not cost anything.

Diagnosis at no costOne fixed quote, in writingNothing signed
02

Image the disks, alter nothing

No analysis can begin without all members having their own sector-by-sector images taken. While that happens the power to the chassis remains off so that the firmware cannot run a self-recovering script and nothing is written to the original disks.

Every member clonedUnit stays powered off
03

Rebuild the layout on the images

All processes beyond this point occur against the copied images: partitions are mapped out; Buffalo's array configuration information (that tells us what order the members are arranged in and what chunk size is used) is translated into usable information; the array is then constructed outside of the unit; and finally, either the XFS or ext4 file system is mounted read-only.

Metadata read, array assembledMounted read-only
04

Repair what has broken

Whether it is the array, the partition table or the file system, the repair work is always done on an assembled copy, never on your storage devices themselves. Damaged XFS logs or ext4 journals, for example, are repaired on that copy as needed. Then we go through each shared folder and confirm they are all OK.

Repaired on the copyEvery share opened
05

Opened, verified, and sent home

You don't get charged anything until you've confirmed and authorised that everything is fine after seeing the entire list of what was recovered. Any recovered items are returned via brand-new storage media and the postage costs for these are covered by us. We do not consider a project complete here until we receive confirmation that you have been able to successfully access and review every item you received back.

You approve the list firstReturned on fresh mediaThe return post is ours

What tends to show up first

  • Error codes simply name errors; they do not tell you why the error occurred. An identical code could result from an array failure, a drive leaving its RAID group or a corrupt firmware image which cannot load, and only by actually checking the drives themselves can the cause be determined.
  • Your storage devices are not like any other Linux disk. Older NAS models store their data using XFS while many newer ones use ext4. However, Buffalo uses its own proprietary metadata format to describe how the array is configured, not a standard superblock. Therefore, inserting a drive from your array into another computer does not provide much information as to the nature of your problem.
  • Failed updates typically do not affect your actual files: your boot partition is relatively small compared to your data partition, and both partitions are completely independent of each other. Typically the loss occurs after the initial failure of the update process, once the recovery tool presents you with options to reinitialise the disks.
  • RAIDs are not backups: many people who have lost data learn this the hard way. Mirrored RAIDs protect against a single disk failure, but they do absolutely nothing about accidental deletions, ransomware infections, enclosure failures or a unit knocked off a desk. In fact, most of the boxes we open held data with no backups at all.

The detail that decides most of these cases: because a Buffalo array uses its own unique RAID descriptors instead of a standard superblock, to rebuild it from a set of images we need to establish which disk corresponds to which location (bay), determine which chunk size was used by the system, and identify where the start position for each disk is located in relation to the others, all before a single share appears. If we perform those steps incorrectly we will see nothing on any of the disks; but if we do it correctly, a unit that even the factory firmware has written off usually gives everything back.

From the casebook, lately.

MH · MHD-2026-6857ON RECORD ✓

A four-bay NAS with mismatched disks, undone by its own rebuild

This Buffalo TeraStation had two 8 TB drives and two 4 TB drives, and one member was already down. The TeraStation's own rebuild ran overnight, but it halted in the middle of the night and indicated that the RAID was now failed. A closer inspection revealed Buffalo's own RAID descriptors and an XFS volume that the factory firmware could no longer mount. So, we created exact images of all four disks. After establishing member order and start offsets from those images, we were able to open each of the shares just as they had been prior to failure.

All shares recovered5 days from arrival

Before it comes to the lab.

Do these now

  • Turn off your device as soon as EM (emergency mode) or a fault code appears.
  • Label each disk with its corresponding bay number.
  • Prior to sending your disks to us, please obtain a quote first. Send either your complete NAS device if you cannot remove your disks, or your individual disks, untouched.
  • Please tell us the model number and array type if you know them.

Things best not done

  • Re-run the firmware updater once again to attempt to correct any errors that may have caused the problem.
  • Point xfs_repair or fsck at the original disks.
  • Accept Windows' request to initialise each disk that it identifies.
  • Swap each disk into each bay to locate the failing disk.

Questions we are asked about Buffalo NAS units.

EM mode on a LinkStation — is the data lost?

Only occasionally. EM means emergency mode and refers to when firmware doesn't boot; this doesn't mean the array has failed. The disks are removed from the chassis, so what the LED lights are indicating on the front panel does little to determine the outcome. Switch off the unit and every alternative remains available.

Can I read Buffalo disks by putting them in a Linux PC?

Rarely, no. Older LinkStations and TeraStations used XFS file systems and newer ones use ext4. While a generic Linux machine will list the partitions, it will most likely refuse to assemble them because of Buffalo's proprietary metadata; if you work from images and can determine the drive order and each chunk size, it will mount the volume in read-only mode on plain hardware.

A firmware update killed it — are the files gone?

Almost never. An uncompleted update will damage the minimal OS partition the device boots from, but not your share space (which resides on a separate data partition that is normally untouched). Your main concern should be the subsequent recovery routine that gives you the opportunity to reinstall the firmware, and reinitialises the disks when it does.

The NAS is RAID — surely that counts as a backup?

No. RAID allows you to lose only one disk before losing the entire volume, and it protects against nothing else: deletion, ransomware, a damaged enclosure, improper updates or pulling a unit off a desk and damaging its internal components each result in complete loss of all content. Most Buffalo devices we have recovered had been the sole copy of some data. If the disks will not come out, the NAS can travel to the Guildford intake lab whole, with the drives still in it: get a quote first, by phone or with the form, then post it tracked and insured or drop it off there (Monday to Friday, 9am to 5:30pm, no appointment needed).

More of the jobs we've closed.

NAS recovery → Recovering RAID 5 → Encrypted by ransomware → Media we work with →

Switched off, it keeps every chance it has.

Every additional power-up asks for even more of a drive that is already starting to fail. First open a case with us, and let the free diagnosis tell you how much remains.

0800 6890668

Ask for a free diagnosis Posting it to us