Open, and logging new jobs · weekdays, 9am–5:30pm Phone is quicker: 0800 6890668
HDR Hull Data Recovery 0800 6890668 Price it up
HDR / The devices we recover / The NAS box

Devices · NAS and network drives

NAS recovery for Hull. Everything lived on one box, until a bay light turned red.

Most NAS failures are quiet ones. Everything still mounts, everything still opens, and a disk can be dead in bay three for a month before anyone looks. The damage comes at the next step: DSM or QTS puts up a scrub, a repair, a rebuild; somebody accepts; the pool goes. Power the box down and leave it down, wherever in Hull it stands. They reach us from a freight office on Hedon Road, a solicitor's practice in Beverley, a fabrication shop outside Scunthorpe.

Most jobs: nothing back, nothing to pay Free to look at, then one fixed price Parcels come in from Beverley, Grimsby and Skegness

An engineer will take the details
0800 6890668

This turns up most weeks. Ordinary bench work.

None of these? Use the triage →
Sending it to us: pack it well, insure it for the full value and send it tracked to the Leeds intake lab. Return postage is ours. If you want an engineer to look over the packing before you tape the box shut, ring first. The detail is in the sending page.

The NAS brands that come in most often.

SynologyDiskStation and RackStation boxes running DSM: btrfs or ext4 sat on top of SHR.
QNAPTS and TVS models, on QTS or on QuTS hero. The boxes ransomware crews scan for first.
BuffaloTeraStation and LinkStation. They put an E-number up and stop.
Netgear & WDReadyNAS and My Cloud: usually every family photograph on one box.

What those NAS error messages mean.

Yours not listed? →
What you seeWhat the fault isWhat to try
Synology: Volume CrashedToo many disks gone for parity to coverCut the power before DSM suggests a fix
Synology: Storage Pool DegradedOne disk is out; the layers above carry on regardlessEvery hour it runs costs you
QNAP: system volume not active; RAID unmountedQTS built the volume and can no longer mount itPut it together off the box
DeadBolt — WARNING: Your files have been lockedRansomware; .deadbolt on the end of every filePhotograph the note; change nothing
Buffalo TeraStation E14 — Cannot mount the RAID arrayNothing wrong with the array; the box will not start itWrite the E-number down, then unplug it
Buffalo TeraStation E16 — The hard disk was not foundEither the disk is dead or the box has lost sight of itThe files are generally still on it
Buffalo TeraStation E30 — The hard disk may be brokenA disk has been thrown out of the setRefuse the rebuild

From the box arriving to the files going back.

Jobs we have logged →
01

A case number first, then a free diagnosis Free

Each item that arrives gets a case number the day it lands. An engineer looks at it and finds the real fault, and that costs you nothing. You are told in plain terms which files can come off the drive and which cannot. A price follows — one figure, written down. No work starts until you have seen it and agreed to it.

The diagnosis is freeOne price, put in writingNothing to pay yet
02

Copies before anything else

Every disk gets a full copy on imaging hardware built for the job, weak areas included. After that, all the work is done against those copies. The enclosure sits powered off on our bench, so it never picks up where it left off.

Copied read-onlyNever rebuilt in the box
03

Up through the layers

A NAS volume is almost never a single object. On Synology it is matched partitions, an md array over each group, LVM over all of it. Buffalo, Netgear and QNAP arrange theirs differently again. Every tier goes back up in software, bottom first.

mdadm and LVM taken apartSHR partitions paired
04

The file system last

Once the stack holds, btrfs or ext4 is repaired. Shares come back named as you named them, with the folder tree as it was. You get the full listing and check it yourself; nobody here closes the job until you have.

btrfs or ext4 fixedShares returned with their own names
05

You sign it off, then it comes back

You are not billed while you are still thinking. The list of what came off the drive goes to you first, and the invoice waits on your word. Files go home on media bought in for the job, with the postage back on us. We keep the job open until you have opened them on your own machine.

You approve the listing firstCopied onto new mediaReturn postage at our cost

What turns up most often

  • There is nothing proprietary about SHR — it is mdadm with LVM on top, laid over partitions cut to match across disks of different sizes. Each layer is put back separately in software, always against images, with the box itself unplugged on another bench. We have yet to see the repair button save one of these.
  • Degraded is a clock, not a state — putting an SHR or RAID 5 pool back together asks every surviving disk to read straight through without a stumble. Those disks came out of one box, went into the bays on a single afternoon, and have run warm together ever since. One of them tends to stop part-way.
  • The case is the least of it — Buffalo, Synology and the rest write the layout of the array onto the disks, not into the box. A dead power supply is one of the better faults to see arrive.
  • Ransomware makes a NAS into evidence — photograph the ransom screen before anyone restarts anything. A reboot can clear the note away, and the reference number printed on it goes with it. What happens next is covered on the ransomware and forensics pages.

The lesson of 2022: the first DeadBolt wave, on 25 January 2022, caught roughly 3,700 QNAP boxes that answered from the open internet, and more waves came through that year. QLocker and eCh0raix had already been over the same ground. Two things were true of nearly every victim: the box could be reached from outside, and its firmware was whatever shipped in the carton.

One case from the casebook.

HU · HUL-2026-0785LOGGED ✓

A NAS at Skegness, and a rebuild that made it worse

Two red lights, and the box was still savable. It was the rebuild someone kicked off next that finished it: the unit's own metadata got written over. Each disk was then imaged past its bad sectors. The mirror went back together a block at a time, every one taken from whichever disk had read cleanly there. The shared volume came out complete.

100% recovered5 days after it landed

Before you box it up.

Do these first

  • The moment it says degraded, switch it off
  • Mark each disk with its bay before you pull it
  • Bare disks only — keep the enclosure
  • Tell us the model, and whether the pool was SHR or ordinary RAID

What not to do

  • Say yes to a rebuild or a repair
  • Run a scrub on a pool that is degraded
  • Let Windows initialise a disk for you
  • Shuffle disks between bays to see what happens

Asked most weeks, answered here.

The box is dead — no power at all. Have the files gone with it?

Rarely. The disks carry their own description of the volume: which bay each one sat in, the stripe size, every layer stacked above. None of that lives in the chassis. Good disks in a dead box is among the easier work we get.

Send the disks, or send the lot?

Just the disks. Bare drives are what the Leeds lab wants. Take them out one bay at a time and write the bay number on each before it is packed. Post them fully insured, or drop them in yourself. No disk is read for data until it has been imaged.

How does SHR differ from plain RAID?

Synology Hybrid RAID is there to stop odd-sized disks wasting capacity. Every drive is sliced into partitions that find partners across the set; an md array sits over each matched group; LVM ties those arrays into the single volume you see. We take that apart layer by layer, starting at the bottom.

DSM says Volume Crashed and the rebuild stopped. Is it finished?

No. Volume Crashed describes the limits of the box, not the state of the data. Copy every drive, put the pool together in software, and a volume DSM has written off usually reads right through.

A drive left switched off loses nothing more.

Leave it switched off. A failing drive has a limited number of starts in it, and each one spends a little more. The free diagnosis will say which files can be read.

0800 6890668