NAS Data Recovery — Network Storage of All Brands and Configurations

Consultation with a technician Consultation with a technician Free diagnostic evaluation Data recovery price list

Free diagnosticsfree consultation, diagnostics, pick-up

You pay only for successno data – no fee

Express recovery 24/7priority service available

Success rate > 95%own EXALAB laboratory

NAS network storage devices (Network Attached Storage) serve as central data repositories in businesses and homes, combining multiple hard drives in a RAID configuration for greater capacity and data protection. A drive failure, a failed rebuild, a firmware error, a ransomware attack or a natural disaster, however, can still lead to data loss even on a device with a redundant array. We work with all common brands — Synology, QNAP, WD My Cloud, Buffalo, Netgear, Asustor, TerraMaster, Drobo and others — and with their proprietary technologies (SHR, X-RAID, BeyondRAID, TRAID) and file systems (Btrfs, ext4, ZFS, XFS). Diagnostics are free, data recovery pricing starts at CZK 2,500.

NAS has stopped working — what to do and what to avoid:

• Stay calm.
• If the NAS still responds, shut it down properly through the administration interface. If it does not respond, disconnect the power cable.
• Do not use the Reset button on the NAS. On most NAS units (Synology, QNAP, WD) a short press resets the password and network settings — your data remains intact. A longer press, however, can reinstall the operating system or wipe the array configuration. If you are not sure what Reset does on your specific NAS, do not use it.
• Do not perform a factory reset through the NAS administration interface. Some options in the “Restore to Factory Default” menu will only erase settings and keep your data, while others will irreversibly delete all data, including the storage volumes. The difference between these options is not always obvious at first glance — manufacturer forums document numerous cases where a user accidentally chose the wrong option and lost their data.
• Do not remove the drives from the NAS unless specifically instructed by professionals. If you have already removed them, write down the exact slot order.
• Do not start a rebuild of the array unless you are absolutely certain of the cause of failure.
• Do not install a firmware update on a NAS that is reporting problems with drives or volumes.
• Do not run a file system repair (fsck, btrfs check, e2fsck) directly on the original drives.
• Contact us — +420 608 177 773

Content guide

• Quick diagnostics — for those with no time to lose
• Indicative pricing, symptoms and causes by failure type
• NAS brands and models we work with
• NAS operating systems and file systems
• NAS data recovery after a ransomware attack
• What kind of data we recover from NAS
• How NAS data recovery works in our laboratory
• Frequently asked questions — FAQ
• Highly sensitive data? We can sign a non-disclosure agreement
• Is your data insured? We can issue an incident certificate for your insurer

NAS network storage (Network Attached Storage) is now a common component of both business and home IT environments. It serves as central storage for documents, databases, backups, multimedia files and surveillance footage. Even though a NAS offers some degree of data protection through its integrated RAID array, it is not immune to failure — whether from drive faults, firmware errors, ransomware attacks or improper user intervention.

At the EXALAB laboratory we have been recovering data from network storage devices since 2006. The laboratory is operated by Microshop s.r.o., which holds ISO 9001:2016 and ISO 14001:2016 certifications. A detailed overview of brands and their specifics can be found in the section NAS brands and models. Diagnostics are provided free of charge and without obligation. We have most spare parts in stock, and express solutions are available outside business hours as well.

NAS data recovery — quick diagnostics. For those with no time to lose

Consultation, diagnostics and pickup are always free of charge.

• NAS has stopped responding, data is inaccessible. Take advantage of our free consultation. We will assess the situation together and propose a solution. Call us at +420 608 177 773.
• NAS reports a drive failure or a degraded array. Power the device off, write down the drive positions, and use our free diagnostics. More on this issue here.
• NAS stopped working after a firmware update. Do not attempt further updates or a factory reset. More on this issue here.
• NAS does not power on or does not respond at all. The drives look fine, but the NAS itself does not work. More on this issue here.
• NAS hit by ransomware (Deadbolt, Qlocker, eCh0raix…). Disconnect the NAS from the network, but do not power it off. More on ransomware.
• Accidentally deleted data, formatted volume. Do not continue using the device. More on this issue here.
• NAS physically damaged (drop, power surge, flood). Do not power the device or drives on, and contact us.

Indicative pricing, symptoms and causes by NAS failure type

• Failure of one or more drives in a NAS
• Firmware or operating system failure of the NAS
• Failed rebuild of the disk array
• Inaccessible volume — “Volume Crashed”, “Storage Pool Degraded”
• Controller or NAS hardware failure
• Deleted data, formatted volume, factory reset
• Mechanical damage, power surge, natural disaster

Failure of one or more drives in a NAS

Symptoms:

• NAS signals a drive failure (amber or red LED next to the slot, audible alarm, email notification)
• data is partially or completely inaccessible
• the array shows as “degraded” or “crashed” in the NAS administration

Drive failure is the most common cause of NAS data loss. Drives in network storage typically run continuously and are subject to higher thermal and vibration stress. Failure can occur due to wear, manufacturing defects, damage to the platter surface (HDD), controller or firmware failure (SSD), or electrical damage. If the NAS uses a RAID configuration tolerant to a single drive failure (RAID 5, SHR) and one drive fails, the array goes into a degraded state — data is still accessible, but without redundancy. If another drive fails at this point, data becomes inaccessible. The price depends on the number of drives, the configuration, and the extent of damage. You only ever pay for a successful data recovery.

Indicative price: from CZK 5,000
More information — drive failures in NAS
Free consultation, diagnostics, pickup

Firmware or operating system failure of the NAS

Symptoms:

• NAS will not boot, stuck in a bootloop (endless restart)
• NAS stopped responding after a firmware update
• NAS is visible on the network but you cannot log in
• NAS reports “System Partition Failed” or a similar error

Every NAS runs its own operating system — Synology DSM, QNAP QTS/QuTS hero, WD My Cloud OS, Buffalo firmware, Netgear ReadyNAS OS and others. An operating system failure does not necessarily mean data loss — user data is stored on the drives separately from the system partition. The problem can arise, however, when a user attempts to reinstall the firmware or runs one of the factory reset variants without understanding the difference between a settings reset (data preserved) and a full reinitialization (data may be deleted). Contact us before you try anything else.

Indicative price: from CZK 2,500
More information — NAS firmware failure
Free consultation, diagnostics, pickup

Failed rebuild of a NAS disk array

Do not start a rebuild unless you are absolutely certain of the cause of failure! You may turn a solvable case into a complicated one — or worse…

Symptoms:

• rebuild was started after replacing a faulty drive, but it failed or did not complete
• the array went from “degraded” to “crashed” or “failed”
• data is completely inaccessible

A failed rebuild is one of the most common causes of NAS data loss we see in practice. The typical scenario: after a single drive fails, the NAS starts rebuilding the array on a new drive, but during the process another drive from the remaining set fails — under the increased load, a previously hidden defect surfaces. A rebuild failure can also be triggered by a power outage, by inserting an unsuitable or faulty replacement drive, by swapping slots, or by a NAS firmware bug. Details on why rebuilds fail and how to prevent it can be found on the RAID data recovery page in the section on failed rebuilds.

Indicative price: from CZK 5,000
Free consultation, diagnostics, pickup

Inaccessible volume — “Volume Crashed”, “Storage Pool Degraded”

Symptoms:

• NAS reports “Volume Crashed”, “Storage Pool Crashed” or “Storage Pool Degraded”
• the volume appears as “Not Active” or “Inactive” in the administration
• shared folders are empty or inaccessible, even though the NAS otherwise appears to be working

These error messages indicate that the NAS cannot read the disk array metadata or the file system. Possible causes include file system damage (Btrfs, ext4, ZFS), unexpected shutdown, power outage, a hidden drive failure or a software bug in the NAS operating system. Improper handling — especially attempts to repair the file system directly on the original drives — can make the situation irreversibly worse. In our laboratory we always start by creating binary copies of all drives and only then proceed to analysis.

Indicative price: from CZK 2,500
Free consultation, diagnostics, pickup

Controller or NAS hardware failure

Symptoms:

• NAS does not boot, no LEDs lit (or only the power LED)
• NAS is not visible on the network even though it is powered on
• drives are physically fine, but the NAS itself does not work
• failure of the power supply, mainboard or controller

It is not only the drives that can fail — the NAS itself is an electronic device subject to wear. A faulty power supply, a mainboard failure, a controller burned out by a power surge, or a failure of the internal firmware flash module (on some QNAP models) can all cause the NAS to stop working even though the data on the drives is intact. In such cases we remove the drives from the non-functional device and reconstruct the data outside the original NAS. Inserting the drives into a different NAS (even of the same model) without expert consultation is risky — the new NAS may overwrite the array metadata.

Indicative price: from CZK 5,000
Free consultation, diagnostics, pickup

Deleted data, formatted volume, factory reset

Symptoms:

• data accidentally deleted from NAS shared folders
• a volume or the entire array has been formatted
• a factory reset of the NAS has been performed

With deleted data, the key principle is to stop using the device. Every additional write reduces the chance of successful recovery. On file systems with copy-on-write (Btrfs, ZFS), recovery odds can be higher because data is not overwritten in place — in some cases earlier snapshots can be used to retrieve the data. On ext4, success depends on whether new data has been written over the area occupied by the deleted files.

NAS factory reset and its impact on data: Most NAS units offer several levels of reset. A hardware reset via the button (short or long press) typically resets only the password, network settings or system configuration — user data on the drives is preserved. A software factory reset from the NAS administration interface, however, can offer options that irreversibly delete all data, including the disk volumes. The names of these options vary between manufacturers and are not always intuitive — on QNAP, for instance, “Restore Factory Defaults & Format All Volumes” wipes everything, while “Reset Settings” preserves the data. If you have performed any kind of reset and your data is now inaccessible, do not attempt anything further — the chance of recovery depends on what exactly the NAS did, and a professional laboratory can determine this from drive analysis.

Indicative price: from CZK 2,500
Free consultation, diagnostics, pickup

Mechanical damage, power surge, natural disaster

Do not power on the damaged device or drives! Any further attempt to start the device can irreversibly worsen the situation.

Symptoms:

• NAS physically damaged (drop, impact, flood, fire)
• drives damaged by a power surge during a storm or by a short circuit
• the device or drives show visible damage

Do not handle the device or drives in any way and do not attempt to power them on. Contact us and we will discuss the next steps together. Pickup is free throughout the Czech Republic.

Indicative price: from CZK 5,000
Free consultation, diagnostics, pickup

NAS brands and models we work with

NAS data recovery requires knowledge of the specific platform — every manufacturer uses a different operating system, a different approach to array management, and often proprietary technologies. We handle all common and less common brands:

Synology

The most widespread NAS brand on the Czech market. Operating system DSM (DiskStation Manager, currently version 7.x). The proprietary RAID configurations SHR (Synology Hybrid RAID) and SHR-2 allow drives of different sizes to be combined. File system Btrfs (default since DSM 6.1 — snapshots, checksums, self-healing on RAID) or ext4 (older installations). Under the hood, SHR uses standard Linux MD RAID, which makes reconstruction in a professional laboratory more straightforward. Model lines: DiskStation DS (desktop), RackStation RS (rackmount), FlashStation FS (all-flash).

QNAP

The second most widely used NAS brand. Operating systems QTS (ext4-based) and QuTS hero (ZFS-based — higher data integrity, but more demanding recovery). Drives from QTS and QuTS hero installations are not interchangeable. Model lines: TS (tower), TVS (high performance), TBS (compact). QNAP is unfortunately a frequent target of ransomware attacks — Deadbolt, Qlocker, eCh0raix. See the Ransomware section for details.

WD My Cloud (Western Digital)

A popular NAS for households and small businesses. Three architecturally distinct device categories. Classic models (My Cloud, My Cloud Mirror Gen 2) — single-drive or dual-drive (RAID 1) devices running Linux with ext4. Multi-bay models (EX2 Ultra, EX2100, EX4100, PR2100, PR4100, DL2100, DL4100) — Linux mdadm software RAID with ext4, running the My Cloud OS 5 operating system; supporting RAID 0, 1, 5, 10 and JBOD. My Cloud Home and Home Duo — a different architecture built on a proprietary REST SDK layer over ext4, where user data is stored as anonymous hexadecimal content IDs and the mapping is held in an SQLite database; recovery requires a specific procedure. A common cause of data loss in recent years has been the forced migration from OS 3 to OS 5 (2021–2022). The older DL2100/DL4100 models are out of manufacturer support.

→ Per-type detail: Data recovery from WD My Cloud network storage

Buffalo

Model lines LinkStation (home/SOHO) and TeraStation (business environments). File systems XFS (primary) and ext4 (newer models). Buffalo NAS units feature an E-code diagnostic system (E04 — corrupted firmware, E13 — RAID error, E14 — cannot mount RAID, E15 — disk I/O error, E22 — mount failure, E30 — disk damage). On firmware failure, the NAS enters EM Mode (Emergency Mode).

Netgear ReadyNAS

Proprietary X-RAID / X-RAID2 technology (an expandable RAID that automatically partitions storage into zones based on the smallest drive). Operating system ReadyNAS OS 6 (Btrfs-based). Netgear has effectively discontinued its NAS product line — no new models are being produced, and the ReadyCLOUD service was shut down in 2023. Users with these devices have no manufacturer support.

Drobo

Proprietary BeyondRAID technology — a completely different format for storing data at the block level, which cannot be read by standard tools on Linux or Windows. File system ext3 on top of the proprietary layer. Drobo (StorCentric) filed for bankruptcy in 2023 — support and services have been terminated. Data recovery from Drobo NAS requires specialized tools and is among the most technically challenging cases.

Other brands

Asustor (ADM operating system, Btrfs/ext4, model lines Drivestor, Nimbustor, Lockerstor — Deadbolt ransomware target in 2022). TerraMaster (TOS 6 operating system, proprietary TRAID RAID, ext4/Btrfs, F and U model lines). UGREEN (UGOS Pro operating system, NASync DXP line — the newest entrant to the NAS market, launched in 2025). Thecus (ThecusOS, essentially no new products since 2017). LaCie (today a Seagate brand, NAS products discontinued). We also work with DIY and open-source NAS solutions on platforms such as TrueNAS/FreeNAS (ZFS), OpenMediaVault and Unraid.

If you do not see your NAS brand on the list, do not hesitate to contact us — there is a strong chance we have experience with your specific device as well.

NAS operating systems and file systems

The way data is stored on a NAS varies by manufacturer, model and operating system version. For data recovery, knowledge of the specific file system is critical — each one has a different metadata structure, a different approach to journaling, and different recovery options.

Btrfs (B-tree file system) — the default file system on Synology (since DSM 6.1), optional on QNAP, Asustor and TerraMaster. Copy-on-write (CoW) technology means data is not overwritten in place, which increases the chance of recovery after deletion. Supports snapshots, checksums and self-healing on RAID.

ext4 — the most widespread file system in the NAS environment. Default on QNAP (QTS), WD My Cloud, older Synology and many others. A journaling file system with a long history and well-documented structure. Standard ext4 data recovery tools work reliably.

ZFS / OpenZFS — used by QNAP QuTS hero and TrueNAS/FreeNAS. A 128-bit file system with end-to-end checksums, self-healing and RAID-Z. Offers the highest data integrity, but recovery from ZFS is more technically demanding — it requires knowledge of specific metadata structures (Überblock, vdev labels, DMU).

XFS — the primary file system on Buffalo NAS (LinkStation, TeraStation). High performance for large files. Not natively readable on Windows or macOS.

BeyondRAID (Drobo) — a fully proprietary block-level layer. Drives from a Drobo NAS cannot be read on any standard operating system. Recovery requires specialized tools.

In the NAS environment we also encounter the file systems ext3 (older Buffalo, Thecus, Drobo), NTFS (USB drives connected to a NAS), HFS+ (Time Machine backups on a NAS) and VMFS (virtualization environments on an iSCSI LUN).

NAS drive failures — why they happen and how to minimize the risk

Drives in a NAS typically operate 24/7. They are subject to higher thermal and vibration stress than drives in standard computers. Even quality NAS-grade drives (WD Red, Seagate IronWolf, Toshiba N300) have a limited lifespan, and after several years of operation the probability of failure increases.

A particularly risky situation arises when the drives in a NAS come from the same production batch and were installed at the same time — they have a similar lifespan and can start failing at roughly the same point. For this reason we recommend using drives from different production batches in a NAS and regularly monitoring their condition through S.M.A.R.T. diagnostics in the NAS administration.

Another risk is the use of regular desktop drives in a NAS. NAS-grade drives feature TLER (Time-Limited Error Recovery) and are built for continuous operation in a multi-drive environment. Desktop drives lack these properties and can cause problems in a NAS — from slowing the array down to having a functional drive ejected by the controller. It is also not advisable to mix conventional recording (CMR) and shingled recording (SMR) drives in the same array — more on this in our article on SMR drives.

Free consultation, diagnostics, pickup
Pricing — NAS drive failures

NAS firmware failure — why updates and factory resets can be dangerous

The NAS operating system is stored on a separate partition — on the system area of the drives (Synology, QNAP), on an internal flash module (some QNAP models), or on a dedicated flash storage (Buffalo, Netgear). User data is stored separately on the data volume.

When firmware fails, the user's natural reaction is to reinstall the firmware or perform a reset. The consequences, however, vary significantly depending on the type of reset and the NAS brand:

• Hardware reset via button (short press, 3–4 seconds): on both Synology and QNAP, this resets only the administrator password and network settings. Data and array configuration remain untouched. This is generally a safe operation.
• Extended hardware reset (long press, 10+ seconds): on QNAP, this resets all system settings, user accounts and shared folders — but data on the volume remains; the shared folders just need to be recreated. On Synology (Mode 2) this reinstalls DSM but typically preserves the data volumes and storage pool.
• Factory reset from the administration interface (software): this is where the greatest risk lies. QNAP offers a “Restore Factory Defaults & Format All Volumes” option, which irreversibly wipes all data. Synology offers “Erase All Data” with the same result. These options sit in the menu next to safer variants, and a panicked user can easily choose the wrong one.

In our laboratory, when firmware fails, we bypass the NAS operating system and work directly with the drives at the file system and RAID metadata level. The data on the drives is typically intact — the NAS just cannot read it because of a damaged system area. Even in cases where a user has performed an inappropriate reset, recovery is often still possible — it depends on exactly what the NAS did to the drives.

Typical firmware failure examples:

• Synology: “System Partition Failed”, “System partition cannot be accessed”, bootloop after a DSM update
• QNAP: “QTS system volume not found”, bootloop, internal flash module (DOM) failure
• WD My Cloud: flashing red LED (corrupted firmware / Safe Mode), “Error Code 1121: Unsupported File System”
• Buffalo: error codes E04, E06 (firmware corruption), entering EM Mode (Emergency Mode)
• Netgear ReadyNAS: “Could not mount Root RAID”, “Corrupt root”, ReadyNAS OS 6 fails to boot

Free consultation, diagnostics, pickup
Pricing — NAS firmware failure

NAS data recovery after a ransomware attack

NAS network storage devices have become a frequent target of ransomware attacks in recent years. Unlike classic ransomware aimed at computers, this is malware specifically targeting vulnerabilities in NAS operating systems — particularly QNAP, but also Synology and Asustor.

Most common NAS ransomware

Deadbolt — targeted QNAP, Asustor and TerraMaster NAS units (from January 2022). Encrypts files with AES-128, .deadbolt extension. The Dutch police intercepted 155 decryption keys, and Emsisoft released a decryption tool — but only if the key is available.

Qlocker — targeted QNAP NAS units (from April 2021). Packs files into password-protected 7z archives. No free decryption tool exists.

eCh0raix / QNAPCrypt — targeted both QNAP and Synology NAS units (from 2019). Encrypts files, .encrypt extension. A free decryption tool exists only for versions before July 2019.

SynoLocker — historically the first NAS ransomware, targeting Synology NAS units running DSM 4.x (2014).

Checkmate, AgeLocker, Muhstik — further variants targeting QNAP NAS units.

Recovery options depend on the specific ransomware variant, on whether the encryption completed, and on the NAS file system. In some cases data can be recovered from earlier snapshots (if the NAS supported them), from partially encrypted files, or from free space on the drives where older versions of the data may reside.

What to do during a ransomware attack on a NAS: Immediately disconnect the NAS from the network (unplug the network cable), but do not power the NAS off — the RAM may hold decryption keys that will be lost on power-off. Contact us as soon as possible.

Free consultation, diagnostics, pickup

What kind of data we recover from NAS

NAS network storage typically holds data whose loss can be critical for businesses and households alike:

Business documents and databases — contracts, invoices, correspondence, internal documentation. A NAS often serves as the central file server for an entire company.

Accounting and ERP software — Czech businesses typically store databases of platforms such as POHODA (.mdb files in the basic edition, Microsoft SQL Server in the network edition), Money S3/S4/S5 (SQL Server .mdf/.ldf databases), Helios (SQL Server or Oracle), Abra and others on the NAS. Loss of these databases can directly disrupt company operations.

Backups — a NAS is often the destination for backup software (Synology Hyper Backup, QNAP HBS 3, Veeam, Acronis). Paradoxically, this makes the NAS the only place where backups are kept — and if it fails, the backups disappear with it.

Virtual machines — VMware, Hyper-V, Proxmox and other platforms can store VM images on an iSCSI LUN provided by the NAS.

Surveillance footage — Synology Surveillance Station, QNAP QVR Pro and other security camera management systems write recordings directly to the NAS. These recordings can have evidentiary value.

Family photos and videos — on home NAS units, these are often unbacked-up, irreplaceable files spanning many years.

How NAS data recovery works in our laboratory

1. Consultation and intake
Contact us by phone, email or through the form. We will assess the situation together. Pickup of the NAS or the drives is free throughout the Czech Republic.

2. Diagnostics
We perform thorough diagnostics on all drives from the NAS. We test their condition, read the disk array metadata and NAS configuration, and evaluate recovery options. Diagnostics are free and without obligation — you will receive a report describing the condition, the price and the estimated turnaround.

3. Data recovery
As the first step we create binary copies of all drives (sector-by-sector images) using hardware write-blockers, which physically prevent any write to the original drives. If any drive is mechanically damaged, cloning is preceded by repair work in the cleanroom environment of our laboratory. Only then do we work over the created copies to reconstruct the disk array, the file system and the data itself — the original drives are kept safely stored throughout the process.

4. Handover of recovered data
After recovery is complete, you receive an overview of the recovered files. We hand over the data on a new medium (an external drive, encrypted transfer). You only pay for successfully recovered data.

Free consultation, diagnostics, pickup

Frequently asked questions — FAQ

• What should I do when my NAS stops working?
• How much does NAS data recovery cost?
• How long does NAS data recovery take?
• Can I recover NAS data on my own?
• Do you need the whole NAS, or just the drives?
• Can I put the drives into another NAS of the same brand?
• Can I take the drives out of the NAS and read them on a computer?
• Is it possible to recover data from an encrypted NAS volume?
• What is the difference between SHR and classic RAID 5?
• Is it possible to recover data from a NAS after a ransomware attack?
• Is a NAS a backup?
• How can NAS failure be prevented?

What should I do when my NAS stops working?

Power the NAS off in the standard way (if possible) or disconnect the power cable. Do not remove the drives, do not run a factory reset, do not install firmware. Make a note of anything the NAS displays or reports (error messages, LED indications, sounds). Contact us — consultation is free and we will help you assess the situation. A detailed procedure can be found in the section What to do when a NAS stops working.

How much does NAS data recovery cost?

The price depends on the type of failure, the brand and model of the NAS, the number and condition of the drives, and the array configuration. Indicative pricing can be found in the overview by failure type. We will provide an exact quote after the free diagnostics. We offer several processing speed options — a faster option costs more, a slower one less. You only pay for successfully recovered data.

How long does NAS data recovery take?

Turnaround depends on the number and condition of the drives, the type of failure and the chosen processing option. For less serious cases (logical failure, firmware) it is on the order of days. For more complex cases involving mechanically damaged drives it can take several weeks. Express solutions are available outside business hours as well.

Can I recover NAS data on my own?

If all drives are physically fine and the problem is purely software-related (deleted data, damaged file system), software recovery tools exist (R-Studio, UFS Explorer and others). That said, working directly with the original drives without first creating a safe copy is risky. If the cause of failure is hardware-related, or you are not sure, leave the case to a professional laboratory.

Do you need the whole NAS, or just the drives?

In most cases sending just the drives is sufficient — we reconstruct the array from the metadata stored on the drives themselves. In some cases (firmware failure, proprietary configuration) it can be useful to include the NAS device as well. We will tell you what exactly to send during the phone consultation.

Can I put the drives into another NAS of the same brand?

You risk the new NAS overwriting the array metadata or the system area with new data during initialization. The manufacturer assumes no liability for data loss caused by moving drives between devices. If you are considering this approach, consult professionals before inserting the drives anywhere.

Can I take the drives out of the NAS and read them on a computer?

Most NAS units use ext4 or Btrfs file systems, which are natively readable on Linux but not on Windows or macOS. Connecting a drive from a NAS to a computer also requires knowledge of the RAID array structure — data is distributed across the drives and cannot be read from a single drive in isolation (except for RAID 1 / mirroring). Inexpert attempts can make the situation worse.

Is it possible to recover data from an encrypted NAS volume?

If you know the encryption key or password, the data can be decrypted after the array has been reconstructed. Both Synology and QNAP allow encryption of shared folders or entire volumes. Without the key, decryption is practically impossible — the encryption algorithms used in modern NAS units (AES-256) are designed to resist any attempt at brute-forcing.

What is the difference between SHR and classic RAID 5?

SHR (Synology Hybrid RAID) is a proprietary Synology technology that allows drives of different sizes to be combined in a single array and makes better use of their capacity. Under the hood, SHR uses standard Linux MD RAID — for data recovery purposes it is a variant of classic RAID that we can reconstruct using standard procedures. SHR-2 corresponds to the principle of RAID 6 (dual protection).

Is it possible to recover data from a NAS after a ransomware attack?

In many cases yes, but it depends on the specific ransomware variant, the extent of encryption and the NAS file system. For some variants (Deadbolt, older eCh0raix) decryption tools exist. On file systems with snapshots (Btrfs, ZFS) earlier versions of the files may be available. The key thing is not to power the NAS off and to disconnect it from the network — decryption keys may be held in RAM. See the Ransomware section for details.

Is a NAS a backup?

No. A NAS with RAID protects against the failure of one or more drives, but it provides no protection against accidental deletion, ransomware, NAS hardware failure, firmware errors or natural disasters. A real backup must exist on another independent medium, ideally off-site. The proven 3-2-1-1 strategy recommends three copies of the data on two types of media, one copy off-site and one on offline storage.

How can NAS failure be prevented?

Regularly check the condition of the drives in the NAS administration (S.M.A.R.T. monitoring). Set up email notifications for errors. Replace faulty drives without delay. Use drives intended for NAS use (WD Red, Seagate IronWolf, Toshiba N300, CMR recording). Consider a UPS to protect against power outages — ideally a model recommended by the NAS manufacturer that can communicate with the NAS over USB and shut it down safely when the battery runs low. Update NAS firmware, but unless there is a critical security flaw, wait a few days and read about other users' experiences first. And above all — back up your data independently of the NAS.

Highly sensitive data? We can sign a non-disclosure agreement

Discretion and treating data as confidential are a given for us. If the nature of the case calls for it, do not hesitate to ask for a formal non-disclosure agreement (NDA). NAS network storage often contains business data, accounting databases, client records, medical records — we understand this and treat such data with appropriate care.

Is your data insured? We can issue an incident certificate for your insurer

Is your data insured? Before confirming the order we can issue an “incident certificate”, which you can use to have your insurer approve the cost of data recovery before you confirm the order.

From our practice — NAS data recovery case studies

From the hundreds of NAS cases that have come through our laboratory, we have selected several that illustrate typical failure scenarios and recovery approaches. Each case has its own specifics — from straightforward drive failures in RAID 1, through failed rebuilds in SHR-2 arrays, to complex recoveries after ransomware attacks.

Need to recover data from a NAS?

Send us your NAS or its drives for free diagnostics — within the Czech Republic we also provide free pickup. After diagnostics you will receive a specific price quote and only then do you decide whether to proceed with recovery. You only pay for successfully recovered data. EXALAB® has specialized in data recovery since 2006.