The quiet box on the shelf was being used to hold both the company files and the family archive. Most of us found out it was never really a backup when a disk dropped out, or a rebuild failed half way through, or it simply went silent one morning. We're able to put WD My Cloud, Synology, QNAP, Buffalo and Netgear volumes back together from the disks themselves. If you can get the disks out, send those. Otherwise, please send the whole NAS.
Every NAS job is diagnosed free. We give you a written, fixed quote before we ever pick up a screwdriver.
In most cases you only pay if we recover your data. Electronic, mechanical, chip-level and physical work is charged at 50% upfront. Ransomware, forensic, BitLocker and CCTV/DVR jobs are charged 100% upfront on acceptance of our fixed quotation. Please refer to the data recovery cost page for full details on costs.
The first job on any NAS is matching the symptom to the fault, and after twenty-odd years these thirty faults cover almost everything that walks through our door.
Designed for, survivable, and also the exact moment the array is only a hair away from real trouble. Treat the amber light as a fire alarm rather than an advisory.
Rebuild load is what finishes off a tired survivor, and it is comfortably the most common NAS disaster booked into our workshop. Not by a small margin either.
The array logic has failed but the data underneath has not. This work requires reconstruction, and there is nothing whatever that the restore button on the box can offer.
One click will reinitialise the configuration of your NAS. On some models, it will also make a start on the data. Good intentions are nice, but it still needs stopping.
Firmware died mid flash around an array that was perfectly healthy. The drives neither know nor care. They come out and they image.
A power outage during a parity write leaves the members inconsistent with each other, and the volume will then decline to mount. This is resolved using full images, where an inconsistency doesn't cost anything.
Box electronics fail much more often than the untouched drives inside them. Imaged members bring the volume back virtually, and the enclosure has always been the replaceable part.
Both carve back while their blocks remain unclaimed, so the variable that matters is time. Act quickly and do not touch anything in the meantime.
Internet accessible boxes are attractive targets. An attacker deletes everything he finds, and the snapshot trees below generally get missed in the sweep.
Pulled out, mixed up, second-guessed and inserted again. The array metadata still knows the correct order, even if nobody else does, as long as the experimenting stops right now.
Synology layers things cleverly and it tears when power is lost mid-thought. It's unpicked from full images, layer by layer, in the same order it was built.
Two bay and four bay DiskStations are what most homes and small firms around Norwich actually run. So their crashed storage pools sit at the top of the rebuild list here.
When a member fails mid-write on a flexible volume, every drive is imaged first, and the volume is only stood up virtually after that.
Even if you've got a "bricked" single bay unit (the box won't boot), you'll find that it has a healthy Linux formatted disk in it. That gets mounted directly, copied out, and that really is the whole job.
Buffalo boxes occasionally lose track of their array definitions. But the member disks remember, so the layout can be taken back off them.
Disks swapped around during cleaning, or during a panic. Fortunately, the metadata will tell you the correct order (although writing a number on each caddy first would have saved a good deal of suspense).
Drives of the same batch (ST4000VN006) wear out at similar rates, so the second failure follows close behind the first. On the day one fails, image the whole set.
Interrupting a capacity expansion leaves a pool that is only partly expanded and cannot be mounted. It is rebuilt from images by following the expansion sequence exactly as it was attempted.
During recovery from an error, WD40EFPX member disks time out and get dropped by the controller for taking too long. On hardware that is prepared to wait, that same drive images cleanly.
A NAS shut in an airless cabinet runs warm for years and then loses drives within a few weeks of each other. That clustering is the signal to image the whole set instead of replacing just one drive.
SMR (shingled) members cope with normal duty but buckle when asked to resilver, as the industry found out in public a few years ago. They are imaged at a shingle-aware pace before any reconstruction starts.
If an archive has never been scrubbed, it has been hiding bad sectors for years, and they all turn up in one afternoon, just when the redundancy has been used up. Imaging first takes the sting out of it.
The small operating system partitions mirrored across the drives become corrupted and the box refuses to boot, while the data volume behind them is perfectly fine. The data is extracted directly from the images.
Block storage carved out of NAS space tears when the volume does. The container file is repaired, and then the file system inside it: two rebuilds, one job.
Faulty RAM writes errors and the file system then records them as being correct. So the volume gets audited instead of simply trusted.
The cache device set up in read-write mode holds data that has not yet been written to the disks. If it is lost or one of a pair of caches is lost then the volume will not mount because part of it is genuinely missing. The cache device is treated as a member in its own right and imaged like one.
When a NAS dies, people typically want to take the hard drives and put them in another one. However, different vendors build their arrays differently, and the new box will usually ask if you want to initialise the old drives. That is the point of no return, so the drives should come to a bench first.
Newer NAS file systems need free space to record changes, and if the volume is full, it can get to the point where it can't even delete files to free up space. Snapshots taking up space make it worse. It's untangled from an image, without any of the risk of doing it live.
Both Synology and QNAP offer folder encryption using a key file which owners are told to keep somewhere safe. Unfortunately, somewhere safe often turns out to be the NAS itself. If the key or passphrase is missing, the folder stays locked, and we say that plainly at the diagnostic stage.
The NAS had been mirroring a laptop, files were tidied up on the laptop, and the mirror deleted them on the NAS side too. Nothing failed, and nothing was attacked. These files can be found in snapshots and unallocated space, and how many come back depends on how long the box has run since.
NAS systems use RAID, or their own version of it, to spread data across their disks. For example, Synology has "SHR" while Drobo had "BeyondRAID", and the tolerance in any of them is thinner than the packaging suggests. One failure gets absorbed quietly enough. The problem is that the rebuild that follows will hammer each remaining disk for hours, which just so happens to be the worst possible time for another disk of the same age from the same production batch to fail. The way we work keeps your disks well clear of all that. First, each of your disks is copied in full. Then the stripe size, disk order and parity rotation are worked out from those copies. Finally, the volume is built in software before any files are copied off. At no point in the process is anything written back to your hardware.
Stop playing with the rebuild button! The wizard will try to sell you on "re-initialising" as your next move, and it's the worst thing you can do from that screen. What you should do instead is shut the unit down cleanly, pull the caddies out one at a time and mark each disk with its bay number as it comes out. Why? Because that order matters a great deal when the array is put back together on a bench. Post the numbered disks and keep the empty enclosure at home. A single disk unit like a My Cloud just needs the outer shell opened and the bare drive sent. If the shell is stuck, call us before trying to force it. We've seen what force does to the plastic clips, and to the disk behind them.
Buffalo boxes turn up here more than you'd expect from their share of the market: LinkStation 210 and 220 systems from homes and small offices, and TeraStation systems from firms that wanted four bays and something that mounts in a rack. Both hide the same comforting fact. Inside each Buffalo unit are standard SATA disks, with no proprietary silicon controlling access to the data and nothing in the enclosure needed for reading the disks. What misleads people is the file system. Buffalo formats its volumes using XFS, with ext3 or ext4 on some of the earlier models, and Windows can't read any of them. So if you connect a LinkStation's disk directly to your PC, the disk shows up as blank with an offer to format it. That is the one offer that should never be accepted. Here, we create a complete image of each member disk, work out the RAID layout from these images instead of from the box that lost track of it, and mount the XFS volume in software so that all of the shares come out as normal folders. The job we see most often is a rebuild that was allowed to run. A LinkStation flags one disk as bad, a replacement goes in, and the rebuild then reads every remaining disk from start to finish over several hours, and a second disk of similar age and the same batch fails partway through, at which point the whole array is down and the enclosure has nothing more to suggest. That is still recoverable from the member disks, and a lot more often when nobody has tried a third rebuild first. Shut it down, number the caddies, post the drives and keep the shell. Buffalo work is priced like everything else on the array bench, from £500 + VAT and rising with the number of disks.
This workshop speaks the vendor RAID dialects that matter, because NAS work is RAID work in different dialects:
Every member of the array is cloned at the same time on dedicated hardware before anyone offers a theory. All the rebuild risk falls on the copies while the originals sit idle and watch.
The order, stripe size, rotation and offset are worked out from the images, then the array is stood up virtually. The geometry is demonstrated rather than assumed.
Any member of an array that fails becomes a full mechanical case in its own right (heads, firmware and boards) until it can be imaged alongside the others.
The solved layout is checked with parity checks and entropy testing before any files are lifted. Nothing goes ahead on a "hunch".
SHR and X-RAID, BeyondRAID, QNAP's flexible volumes, mdadm under LVM, btrfs and ext4: all proprietary layering turned back into plain folders.
Single drive home units opened carefully, with their Linux formatted disks mounted natively and the contents copied out whole rather than piecemeal.
Synology's two-bay DiskStations and QNAP's TS-x53 range are what actually hum along in stockrooms, studies and back offices throughout Norfolk, so they sit at the top of the rebuild list. Drobo closing down left every BeyondRAID owner with lab level recovery as the only route, which is a shame but also a fact. One of the most common questions owners ask is about drive order. The truthful answer is yes, the array metadata does remember it, but writing a number on each caddy before you pull them out will make every later step safer and quicker. Whatever badge is on the front: power it down, number the drives, post the drives, and keep the shell.
DSM has a friendly face and sits on a tall stack. SHR blends drives of different sizes into one pool, mdadm and LVM are below this, and btrfs or ext4 is at the top. This is why a crashed volume on a DS220+ looks like nonsense to general purpose software: the program is looking at one level while the answer is spread across three. The stack is solved in the order someone built it, and always from full images of each member: first the SHR layout is worked out, then the file system is mounted virtually, then the shared folders are walked out intact. There is nothing different about a two bay unit from a spare room and a rack mount unit from a server cupboard. Both go down the exact same path, whatever mix of capacities they held.
Buffalo makes a plain box, and that suits the owner. A LinkStation 210 or 220 holds one or two standard SATA disks. A TeraStation holds four or six of the same, in RAID 1, RAID 5 or RAID 6. Nothing within the unit is needed to read them again. The file system on nearly all recent units is XFS, with older units on ext3 or ext4, and the box has its own operating system on a small partition at the start of every member disk. That is why a Buffalo with corrupted firmware can look like a brick yet all the shares behind it are fully intact. Each disk is imaged, then the array is solved from the images, the XFS volume is mounted in software and the folders are walked out. There are two things users should know about Buffalo. Firstly, the drives tend to come from the same batch, so when a rebuild starts hammering the remaining drives a second failure is very possible. Secondly, the LinkStation's own repair wizard will happily re-initialise a volume it cannot make sense of. Shut down, number your caddies and send the drives.
When somebody adds capacity to a ReadyNAS using X-RAID, the volume is quietly reshaped. The volume then consists of expansion zones laid down one on top of another, like layers of sediment. Standard tools see these layers as damage and say so with some confidence. Put back together in the correct order as the zones were created, the volume mounts exactly as the box intended. The cheap single bay units set a simpler trap for their owners. The disk inside is formatted with ext4 or XFS, Windows doesn't recognise either, so it declares the disk blank and offers to format it. Do not format the disk! The shares are sitting there complete, and both ext4 and XFS mount natively on our benches.
First get a quote, either by phone or with the free online diagnostic. Next shut the unit down properly. Remove each hard drive from the enclosure one at a time and mark it with its bay number (1, 2, 3 and so on) before any of them goes in a box. That order will pay for itself many times over when rebuilding. Only the drives need to travel; the housing can stay with you, unless it's a sealed single bay unit you can't open. Send them tracked and insured, use your own courier, or bring them to reception at our Cambridge location. We do not collect, so the journey is yours to arrange.
Most items arrive at this bench by insured and tracked post. We recommend getting a quote first, either by telephone or using our free online diagnostic, and once you have received your quote, simply post the item. Post is the steadiest way to move a poorly drive, and a parcel sent from Norfolk typically arrives on the bench within a working day.
Is the drive still bolted inside a laptop, desktop, MacBook, iMac, server or CCTV / DVR recorder? Before sending, remove the hard disk drive (HDD) or solid state drive (SSD), as we do not accept whole units. From a DVR or recorder, send just the disk. From a server or RAID, take out the disks and clearly label each disk by bay number. A network attached storage (NAS) device may be sent as its disks if they can be removed; otherwise please send the NAS itself. There is only one type of drive we are unable to accept: storage soldered onto a motherboard (e.g. Apple Silicon Macs, extremely thin laptops). In such cases, if the storage cannot be taken out it cannot be accepted. If you are unsure whether you have a removable drive or not, call us before sending anything.
↓ Print the shipping & booking-in form (PDF)
Please mark the parcel for the attention of Cambridge Data Recovery. It takes about an hour and twenty minutes to travel from Norwich along the A11, then two minutes off the A14 at Junction 32. Otherwise you can post it using a tracked service and we will receive it the following working day. We will contact you as soon as we have your drive and it is booked onto our bench.
If you're unsure of what to include in the box, please call us on 0800 689 0668 before sealing it. Or, for a first view on what we can do, you can use our free online diagnostic.
Free diagnosis, one fixed figure written down, and in most cases you only pay if we recover your data. Start online or ring us.