When a NAS fails, the data on it is rarely the kind of thing you can easily recreate. Family photo archives going back fifteen years. The small business file share that every workstation maps a drive letter to. The video editing project that’s halfway through post-production. The Time Machine backups for everyone in the house. NAS units are where people consolidate the storage they care about most, which is exactly why a failure is so disorienting. Gillware has been recovering data from failed network-attached storage devices since 2004 from our ISO 5 Class 100 cleanroom in Madison, Wisconsin — from single-bay consumer units like the WD My Cloud and Apple Time Capsule through prosumer and small-business arrays from Synology, QNAP, Buffalo, Netgear, ASUSTOR, Drobo, and TerraMaster. Every case starts with a free in-lab evaluation.
Start a free NAS recovery evaluation →
Stop Using the NAS
The single most common way a recoverable NAS failure becomes an unrecoverable one is continued operation after the first failure. Before doing anything else:
- Power the NAS off. Repeated boot attempts on a failing unit, especially when one drive in a multi-drive array is already degraded, are the fastest way to push a second drive over the edge and lose the array entirely.
- Do not initialize, reset, or rebuild the array from the NAS web interface or the manufacturer’s recovery utility. Most NAS vendors offer some variant of “reset to factory defaults,” “rebuild storage pool,” or “initialize disks” as a troubleshooting step. On a failed array, those operations destroy the metadata our reconstruction process depends on.
- Do not insert replacement drives into a NAS that has dropped its array offline. Most NAS units will treat a new drive as a candidate for an automatic rebuild, and an automatic rebuild against the wrong members or in the wrong state is a documented cause of total data loss.
- Do not run firmware updates in an attempt to fix the problem. Firmware updates on a NAS in a degraded state can change how the on-disk metadata is interpreted and have been known to render previously-recoverable arrays inaccessible.
- Label each drive with its bay position before removing anything from the chassis. NAS units use bay order as part of array identification on most platforms, and a misordered set of drives can add days to a recovery.
- Do not run consumer data recovery software against the raw drives. Tools designed for single-disk logical recovery on a Windows or Mac filesystem don’t understand the embedded Linux filesystems, mdadm RAID layers, LVM, btrfs, or ZFS that NAS units use, and writes from these tools can overwrite reconstruction metadata.
If the NAS is a sealed consumer unit — a WD My Cloud Home, an Apple Time Capsule, or a single-bay Drobo Mini — do not attempt to open the chassis. These units are not designed to be opened by end users and opening them outside a cleanroom can damage the drive inside.
NAS Failures We Recover
Most NAS recoveries come to us through a small number of recurring failure patterns. The ones below are the patterns we see most often across consumer and small-business NAS units.
Storage pool or volume crashed
The NAS boots and reaches its web interface, but the storage pool reports a crashed, offline, inactive, or degraded state. Files are inaccessible from the network. On Synology this often shows as “Storage Pool Crashed” or “Storage Pool not active”; on QNAP it shows as “the storage pool is unmounted”; on Drobo it shows as a flashing red drive light pattern; on Netgear ReadyNAS it shows as “Volume removed.” The underlying cause is usually a multi-drive failure event, a metadata corruption on a single drive that the NAS extends to the whole pool, or an interrupted rebuild that left the array in a partial state. More on crashed Synology storage pools →
Individual drive failure
One drive has clearly failed — the NAS reports it, the activity light is solid red, the drive is making clicking or beeping noises, or it has dropped off the drive map entirely. On a redundant NAS configuration (RAID 1, SHR, X-RAID, BeyondRAID with single-disk redundancy) the array continues to operate degraded, but the window before a second failure compounds the problem is unpredictable. We recover the failing drive in the cleanroom, restore the array’s fault tolerance, and assemble the volume from the imaged set.
NAS won’t boot or power on
The unit was running yesterday and today won’t turn on, won’t reach the boot screen, or boots into a recovery / emergency mode and stays there. Buffalo TeraStation units call this state “EM mode” (Emergency Mode); Synology surfaces it as “Recovery Mode” or as the unit refusing to leave the SAS / SATA bus scan phase; QNAP units may surface a long single beep at boot followed by a hang. The drives in the chassis often hold a fully intact data array; the failure is in the boot firmware, the system partition, or in a board-level component that the chassis can no longer pass POST without.
Failed migration between models
A common Synology and QNAP failure: an owner with a working older NAS (DS214, DS218, TS-251) buys a newer model and migrates the drives expecting a seamless transfer. The destination NAS recognizes the drives but reports the pool as foreign, refuses to import, prompts to reformat, or imports incorrectly and corrupts the volume mid-import. NAS migration paths are documented by the vendors, but the field cases that arrive at our lab are the ones where the migration didn’t go cleanly — usually because of an unexpected drive state, a firmware version gap, or a difference in supported filesystems between the source and destination.
Firmware update bricked the unit
A firmware update is offered through the NAS web interface. The update applies, the unit reboots, and what comes back up is either dead (won’t power on, won’t pass POST) or stuck in a recovery mode the unit can’t exit. The data on the drives is generally intact — firmware updates don’t usually touch the data partitions — but the unit that the data lives in is no longer functional. We see this scenario most often on aging NAS units where the firmware update was an attempt to fix some other issue, and on units where the update interacted badly with a marginal hardware component.
Accidental deletion or reset
Someone clicked “Reset to factory defaults,” “Initialize storage pool,” “Quick Format,” or the equivalent. The NAS web interface now shows empty volumes or fresh storage pools where there used to be data. On most NAS platforms the reset operation does not write to every sector of the data drives — it writes new metadata to the start of each disk and trusts the new metadata to mean “this is empty now.” The data underneath the metadata layer is often intact and recoverable through forensic reconstruction of the original filesystem from the surviving data regions.
Ransomware on a NAS share
QNAP units in particular have been heavily targeted by ransomware campaigns over the past several years (DeadBolt, Qlocker, and others), but Synology, ASUSTOR, and even consumer WD units have all been hit. The underlying RAID is usually intact — the encryption sits in the file system at the file or folder level. Recovery options depend on the variant, the time window before encryption completed, whether snapshots existed and were preserved, and whether backup repositories (Hyper Backup, Time Machine, Veeam) are recoverable. Ransomware recovery details →
Sealed unit physical failure
Single-bay sealed consumer NAS units — WD My Cloud, WD My Cloud Home, WD My Book Live, Apple Time Capsule, the original AirPort Disk, Seagate Personal Cloud, Iomega ix2 — are not designed to be opened by end users. The drives inside are accessible only after careful chassis disassembly in a controlled environment. When these units fail — capacitor failure on the controller board, internal drive failure, motherboard event — recovery requires extracting the drive in our cleanroom and imaging it on isolated hardware before any reconstruction work begins.
NAS Brands We Recover
Gillware recovers data from every major consumer and small-business NAS brand. The brand-specific summaries below cover the recovery patterns we see most often on each platform.
Synology
The dominant SMB and prosumer NAS brand, with the broadest model lineup we see in the lab. Common models include the DS220+, DS220j, DS418, DS420+, DS920+, DS1019+, DS1520+, DS1621+, DS214, DS216, DS218+, DS418play, and the older DS213 / DS412+ / DS415+ that are still in active service. Synology uses the DSM (DiskStation Manager) operating system on top of an embedded Linux kernel with mdadm RAID, LVM, and btrfs (default since DSM 6) or ext4 file systems depending on the model and configuration era. Synology’s distinctive RAID variant is SHR (Synology Hybrid RAID), which allows mixed-capacity drives and is built on top of mdadm with custom partition layouts. Recovery patterns we see most often: storage pool crashed and inactive, failed migration between models, DSM update bricking, btrfs metadata corruption on the system or data volumes, and the well-known “DS214 flashing blue power light” hardware failure. Synology data recovery →
QNAP
Synology’s primary competitor in the SMB and prosumer market, with strong penetration in small businesses that need iSCSI, virtualization, or surveillance features. Common models include the TS-228A, TS-251, TS-251D, TS-253, TS-431, TS-431P, TS-451, TS-453, TS-653, and the older TS-209 / TS-219 / TS-410 still found in long-running deployments. QNAP runs the QTS operating system on most models (Linux with mdadm + ext4) and QuTS Hero on the higher-end ZFS-based models. Recovery patterns we see most often: storage pool unmounted after a power event, failed RAID rebuild on TS-x53 and TS-x51 models with consumer-grade SMR drives, snapshot pool corruption on QuTS Hero, and ransomware (QNAP units have been disproportionately targeted by DeadBolt, Qlocker, and similar campaigns). QNAP data recovery →
WD My Cloud and My Cloud Home
Western Digital’s consumer NAS line, and by units shipped one of the most widely deployed NAS lines in the world. The lineup splits into the original My Cloud (single-bay, exposes a standard SMB share, fully user-administered), My Cloud Home (single-bay, requires the WD mobile app, no direct network share access), My Cloud EX2 / EX2 Ultra and EX4 / EX4100 (two- and four-bay prosumer), My Cloud PR2100 / PR4100 (small business), and the older DL2100 / DL4100 lines. The single-bay My Cloud and the My Cloud Home are sealed units that are not designed to be opened, but the drive inside is conventional and can be imaged after careful disassembly in our cleanroom. The multi-bay EX / PR models use ext4 over mdadm and are recoverable through standard NAS reconstruction. We also handle the older My Book Live and My Book Live Duo units, including arrays affected by the June 2021 mass remote-wipe incident.
Buffalo
Buffalo’s LinkStation (consumer 1-bay and 2-bay) and TeraStation (SMB 2-bay through 6-bay) lines have been deployed broadly across small business, retail, and prosumer markets for two decades. Common LinkStation models include the LS210D, LS220D, LS410D, LS420D, LS520D, and the older LS-WVL / LS-CHL units. Common TeraStation models include the TS3210, TS3410, TS5210, TS5410, TS5410DN, and the older TS-XL / TS-RXL units. Buffalo uses an embedded Linux operating system with XFS and ext3/ext4 file systems on mdadm-based RAID. Recovery patterns we see most often: EM mode (Emergency Mode) on TeraStation, where the boot partition has failed but the data partition is intact; LinkStation units that have dropped off the network after a board failure; and TeraStation models that fail to complete a rebuild after a single drive replacement. Buffalo data recovery →
Seagate NAS
Seagate’s NAS line spans the BlackArmor (older 2-bay and 4-bay business NAS), the Personal Cloud and Personal Cloud Home Media (consumer single-bay and two-bay), the Seagate Business Storage NAS series, and various single-drive home NAS units. Many of these lines are discontinued, but the deployed fleet is still substantial. The internal architecture is Linux-based with mdadm RAID and ext4 file systems, similar to other consumer NAS platforms. We also handle Seagate Personal Cloud units that have failed after a Seagate cloud-service deprecation event left the local NAS without a functioning web interface.
Netgear ReadyNAS
Netgear’s prosumer and small-business NAS line, with a strong following in IT-aware home users and small offices. Common models include the RN102, RN104, RN202, RN204, RN212, RN214, RN312, RN314, RN422, RN424, and the older NV+ / Ultra / Pro / Duo units from the pre-ReadyNAS-OS-6 era. Netgear’s distinctive RAID variant is X-RAID (single redundancy, expandable) and X-RAID2 (dual redundancy on newer firmware), built on btrfs over mdadm. ReadyNAS OS 6.x uses btrfs as the default file system, which gives the platform sophisticated snapshot capabilities but also exposes recoveries to btrfs-specific corruption modes. Recovery patterns we see most often: volume removed after a controller event, btrfs metadata corruption on the data pool, and X-RAID expansion failures where adding a drive interrupted the array reorganization mid-operation.
ASUSTOR
ASUSTOR (a subsidiary of ASUS) entered the consumer and SMB NAS market in 2011 and has built a respectable share, particularly among customers attracted by hardware specifications and competitive pricing. Common models include the AS5202T, AS5204T, AS5304T, AS5402T, AS6404T, the Lockerstor 2 / 4, the Drivestor 2 / 4 Pro, and the older AS-31x / AS-32x / AS-50x lines. ASUSTOR runs the ADM (ASUSTOR Data Master) operating system on embedded Linux, with ext4 or btrfs file systems on mdadm RAID. Recovery patterns we see most often: storage pool offline after a power event, ADM update issues on older models, and degraded array recoveries after a multi-drive failure event. ASUSTOR units have also been targeted by ransomware campaigns (notably DeadBolt) and we handle those cases as well.
Drobo
Drobo’s BeyondRAID was one of the most distinctive proprietary storage layouts ever shipped in a consumer or SMB NAS — it allowed mixed drive sizes, automatic capacity expansion when drives were upgraded one at a time, and a single-drive (or optional dual-drive) redundancy model. Drobo’s parent company Storcentric filed for bankruptcy in 2022 and was effectively dissolved, leaving the deployed Drobo fleet with no manufacturer support, no firmware updates, no Drobo Dashboard development, and an aging hardware stack reaching its second decade. Common models include the Drobo 5N, 5N2, 5C, 5D, 5D3, B810n, B810i, the Drobo Mini, and the older B800fs / B800i / DroboPro. Recovery is fundamentally an off-controller BeyondRAID reconstruction; no current Drobo or non-Drobo hardware can read a Drobo array. Drobo data recovery →
TerraMaster
TerraMaster has gained significant market share since 2018 as a value-priced alternative to Synology and QNAP. Common models include the F2-210, F2-221, F2-422, F4-210, F4-221, F4-422, F5-422, and the U-series rack models. TerraMaster runs TOS (TerraMaster Operating System), a Linux distribution with mdadm-based RAID and ext4 or btrfs file systems. The TerraMaster architecture is closer to a standard mdadm + LVM + ext4 stack than the more customized Synology and QNAP layouts, which often makes off-controller recovery more straightforward when the original unit has failed. Recovery patterns we see most often: storage pool offline after a power event, RAID rebuild failure after a drive replacement, and TOS update interruptions that left the unit in a partial boot state.
LaCie
LaCie (a subsidiary of Seagate) targets the creative-professional market with premium-aesthetic external storage and NAS units. The LaCie NAS lineup includes the CloudBox (single-drive consumer NAS), the 2big NAS (two-drive RAID 1 / RAID 0 / JBOD), and the 5big NAS Pro (five-drive RAID 0/5/6/10). Many LaCie storage products sit somewhere between external direct-attached storage and true NAS — the 2big and 5big external lines can be configured as either, depending on the model. We handle the full LaCie product range, including older Network Space units. LaCie data recovery →
Apple Time Capsule and AirPort Disk
Apple discontinued the Time Capsule line in 2018, but the deployed fleet is still substantial — particularly in Mac-only households where Time Machine backups have been running to the same Time Capsule for ten or more years. Time Capsule units are sealed, with a single internal 2 TB or 3 TB hard drive (typically Hitachi or Seagate) running HFS+ with the Time Machine sparse-bundle backup layout on top. The most common Time Capsule failure mode is a board-level capacitor failure on the power supply that leaves the unit unable to power on, with the drive inside fully intact. We extract the drive, image it in the cleanroom, and recover the Time Machine sparse bundles for restoration to the customer’s current storage. AirPort Disk recoveries (USB drives attached to an AirPort Extreme or AirPort Express) follow standard external-drive recovery workflows.
Iomega and LenovoEMC
The Iomega StorCenter line — later rebranded as LenovoEMC after the 2013 acquisition, then discontinued in 2018 — was a major presence in consumer and small-business NAS through the early and mid-2010s. Common models include the StorCenter ix2-200, ix2-dl, ix4-200d, ix4-300d, px2-300d, px4-300d, px4-300r, px6-300d, and px12-350r. These units run the EMC LifeLine operating system on embedded Linux with ext3/ext4 file systems on mdadm RAID. Despite the brand being discontinued for nearly a decade, we continue to see active deployments and recover from the failure modes that have accumulated as the hardware ages out — capacitor failures, BIOS / firmware corruption, and multi-drive failure events on units that have run continuously for ten or more years.
FreeNAS, TrueNAS, and OpenZFS NAS
Custom-built NAS systems running FreeNAS, TrueNAS Core, TrueNAS Scale, or other OpenZFS-based platforms occupy a different recovery profile than consumer turnkey NAS — they’re typically more customized, often run on white-box or repurposed server hardware, and use ZFS as the underlying storage layer. ZFS-specific recovery considerations include pool import failures, vdev fault states, snapshot corruption, and the well-known consequences of an interrupted resilver on a pool with no remaining redundancy. FreeNAS / TrueNAS data recovery →
NAS-Specific Recovery Concepts
NAS recovery differs from raw RAID controller recovery in several important ways, and understanding those differences explains why off-the-shelf RAID tools frequently fail on NAS arrays even when they handle conventional server arrays cleanly.
Proprietary RAID layouts. Most consumer and SMB NAS units do not use the SNIA DDF metadata format that Dell PERC, LSI MegaRAID, and IBM ServeRAID use. They use proprietary layouts on top of mdadm software RAID, often combined with LVM and a layer of custom partition handling that’s specific to the vendor. Synology Hybrid RAID, Netgear X-RAID, Drobo BeyondRAID, and QNAP’s flexible volume system each have their own reconstruction process. Generic RAID recovery software that handles standard mdadm arrays will frequently miss the vendor-specific layout details that make a NAS array reconstructable.
Embedded Linux operating systems. The NAS chassis runs Linux. The boot partition, the system partition, and the data partition are all separate. A failure that prevents the NAS from booting often means the system partition is corrupted but the data partition is intact. We routinely recover from units where the operating system is unrecoverable but the data on the drives is fully present.
File system layers. Most consumer NAS units use ext4 over mdadm + LVM. Synology newer DSM versions default to btrfs. QNAP QuTS Hero and FreeNAS / TrueNAS use ZFS. Each filesystem has its own corruption modes, snapshot semantics, and reconstruction requirements. A ZFS pool with a failed vdev is a fundamentally different recovery problem than a btrfs volume with metadata corruption.
Encrypted volumes. Many NAS platforms support per-volume or per-share encryption. Synology, QNAP, and Drobo all offer it; some users enable it without realizing how recovery from a failed unit will be affected. If encryption is involved, we need the encryption passphrase or key file to recover the data. The encryption key cannot be reconstructed from the drives alone.
Snapshot histories. Many NAS platforms (Synology DSM, QNAP QTS / QuTS Hero, Netgear ReadyNAS, FreeNAS, TrueNAS) support point-in-time snapshots of volumes. In some failure scenarios — particularly ransomware events — snapshots from before the failure event are recoverable and represent the cleanest path to a known-good state. Identifying which snapshots exist, which are reachable, and which are corrupt is part of the recovery scoping process.
How a NAS Recovery Works at Gillware
- Submit the case. Tell us the NAS make and model, what failed, what symptoms you’re seeing, what’s on the array, and whether encryption is in use. We send a prepaid shipping label and ship-safe packaging guidance.
- Receive and inventory. Every drive is logged by bay position, model, firmware revision, and SMART state on arrival. Drives are never operated in the original NAS chassis during this phase. For sealed consumer units, the chassis is opened and the drive extracted in our cleanroom.
- Cleanroom imaging. Each drive is imaged on isolated, write-blocked hardware in our ISO 5 cleanroom. Physically damaged drives are repaired with donor parts as needed before imaging.
- Array reconstruction. Our engineers reverse-engineer the array’s stripe size, drive order, parity rotation, and offset from the on-disk metadata. NAS-specific layout details (SHR, X-RAID, BeyondRAID, ZFS pool topology) are parsed directly from the disk images.
- Filesystem and snapshot recovery. Once the array is assembled, the filesystem layer is recovered against the assembled volume — ext4, btrfs, ZFS, XFS, or HFS+ as appropriate. Where snapshots exist, the snapshot history is parsed and made available alongside the current-state recovery.
- Data return. Recovered data is returned on new media or transferred securely depending on size and sensitivity. We do not return data on the original failed drives.
Why Gillware
ISO 5 Class 100 cleanroom. Drives with physical failures — head crashes, motor problems, scratched platters — can only be safely opened in a certified cleanroom. Sealed consumer NAS units that need to be disassembled to access the drive inside are also opened in the cleanroom environment.
SOC 2 Type II audited facility. If your NAS holds regulated data — healthcare records, financial records, attorney-client material, business-critical files under compliance scope — the audited controls around our handling of it matter. Chain-of-custody documentation is available on request.
Proprietary recovery software. Our in-house RAID and filesystem reconstruction software (HOMBRE) handles NAS arrays that off-the-shelf tools won’t — Synology SHR, Drobo BeyondRAID, Netgear X-RAID, ZFS pools, and the various flavors of vendor-specific mdadm-plus-custom-metadata layouts that consumer NAS units use.
More than two decades of NAS recoveries. Gillware has been recovering NAS arrays since the original Iomega StorCenter and the first-generation Synology DiskStation. We have current and legacy expertise on every major NAS brand still in production and every major brand that has since exited the market.
U.S.-based engineers. All recovery work happens at our headquarters at 1802 Wright Street in Madison, Wisconsin. Your drives do not leave the country.
Pricing and Engagement
The evaluation is always free. After our engineers diagnose the failure and confirm what recovery is possible, you receive a firm written quote — not a range, not an estimate that grows as the work progresses — before any recovery work begins. You decide whether to proceed.
For single-drive NAS recoveries — the My Cloud, single-bay Synology and QNAP units, single-drive Buffalo LinkStations, Apple Time Capsules, and similar — our standard “no data, no charge” engagement applies: if the recovery is unsuccessful, you don’t pay for the work. Multi-drive NAS recoveries (any unit with two or more drives in a redundant configuration) are more complex and may carry an engineering deposit to cover the engineer hours required for parameter reconstruction, filesystem recovery, and donor-drive work, regardless of the final outcome. The deposit and the full price are disclosed in the quote before you authorize the work. More on data recovery pricing →
Start Your NAS Recovery
If your NAS is down and the data on it matters, the next step is to power it off and start a free evaluation. We’ll receive the unit (or just the drives, for multi-bay arrays), image the drives in the cleanroom, reconstruct the array, and quote you a firm price before any recovery work begins.
Start a free NAS recovery evaluation →
Prefer to talk to someone first? Call 1-877-624-7206 during business hours (M–F 8 am–7 pm, Sat 10 am–3 pm Central), or schedule a 15-minute consultation with a client advisor. For business-critical downtime, ask about emergency data recovery service.