NAS Recovery
NAS devices combine RAID, Linux volume managers and vendor file systems. AS recovers at each layer — disks, array, volume and file system — working from images of the drives.
When you need this
- NAS shows volume crashed or degraded
- Firmware update or reset wiped the configuration
- Disks moved to a new unit and the array wasn't recognised
- Btrfs or ext4 volume corruption
- NAS encrypted by ransomware through SMB shares
- Accidental deletion of shared folders
What we do
Disk imaging
Drives are removed and imaged individually; the NAS itself is not used for recovery.
Array and volume reconstruction
mdadm, LVM, SHR and vendor-specific layouts are reconstructed to expose the underlying volume.
File system recovery
ext4 and Btrfs structures are recovered, including snapshots where they survive, which can be valuable after ransomware.
Share-level restoration
Recovered data is organised by share so it can be validated and returned to the rebuilt NAS.
How it works
- Step 1
Consultation and scope
We establish what failed, what has been tried, and which data matters most. This shapes a targeted plan rather than a generic one.
- Step 2
Secure imaging and diagnosis
Where possible the source media is imaged before any work, so the original is never altered. Diagnosis then determines the safest recovery method.
- Step 3
Recovery
Data is extracted from the image or source using methods matched to the failure — logical, structural or hardware-level as required.
- Step 4
Verification
Recovered data is checked for integrity and completeness, and a file list is shared so you can confirm what matters is there.
- Step 5
Secure delivery
Verified data is returned through an agreed secure method, with guidance on validation before it goes back into production.
What affects the outcome
Outcomes are never guaranteed. Every case is assessed on its own condition, and we tell you what is realistic before you commit.
- Physical condition of the media and the extent of any damage
- Whether the media has been written to, reformatted or re-initialised since the failure
- Encryption, corruption or partial overwriting of the data
- Availability of source data such as images, backups, logs or transaction records
- Attempts made before assessment (rebuilds, repair tools, repeated reboots)
Frequently asked questions
My NAS says the volume crashed. Is the data gone?
Not necessarily. 'Crashed' usually refers to the array state; data is frequently recoverable from the disks after assessment.
Can Btrfs snapshots help after ransomware?
Sometimes. If snapshots existed and were not deleted by the attacker, they can provide clean pre-encryption data.
Should I try inserting the disks into another NAS?
Avoid it. Some units initialise unrecognised disks. Leave the disks as they are until assessed.
Related services
Not sure what you're dealing with?
Describe the situation and we'll tell you what's realistic.