Data Recovery from a Simple NAS

NAS (Network Attached Storage) devices have become very popular both in corporate and home network environments. Compared to network file servers based on regular computers, they are smaller in size, less expensive, quieter, and consume less electricity. At the same time, they have the same functionality, including support for various RAID types.

But they have some disadvantages. One of them is that data recovery from them is much harder for the following reasons:.

  • Their hardware is usually based on a non-Intel/AMD CPU architecture.
  • Their OS is a customized Linux OS.
  • And there is usually no way to mount and view the files in the drives from a device other than their built-in ROM.

Moreover, they usually don't have an equivalent to the Trash or Recycle Bin; things that are deleted are typically deleted immediately and permanently. Unlike in Windows or macOS, where you have a chance to restore something from the Recycle Bin or Trash, if something is deleted on a NAS, there's usually no built-in file recovery procedures.

For these reasons, data recovery from a NAS devices requires that its HDDs be removed from the NAS hardware, connected to a computer, and processed on that computer.

As an example of a NAS recovery procedure, we'll show you how to recover deleted folders and files from a set of NAS disks. If the NAS disks were reformatted, you can also use this article to re-create the RAIDs and then follow the instructions in our article Data Recovery from a Re-formatted ext4FS disk.

We will use a D-Link DNS-340L as the NAS hardware.
DNS_340L.png
Fig.1. D-Link DNS-340L NAS
Click image to enlarge

It supports RAID0, RAID1, RAID5, RAID10, and JBOD levels, and uses ext4FS for its file system.

We'll use two 80 GB and one 160 GB hard drives to create a RAID5 from all three drives and JBOD from the remaining space of the 160 GB drive.
NAS_Recovery_01.png
Fig.2. NAS Hard Disk Drives
Click image to enlarge

NAS_Recovery_02.png
Fig.3. NAS RAIDs
Click image to enlarge

Then we can connect those NAS volumes as network drives in Windows.
NAS_Recovery_03.png
Click image to enlarge

NAS_Recovery_04.png
Click image to enlarge
Fig.4. Network Drives

Then we'll write a number of folders and files to those network drives, restart the device, and delete two folders with all their content:
\\DLINK-1B76AF\Volume_1\Photos\Helsinki (jpg files)
\\DLINK-1B76AF\Volume_2\Brazil (jpg files)

Now we can try to recover the deleted files.

Preliminary preparations

  • Prepare a computer to use for data recovery. It may be a Windows, Mac, or Linux machine. We'll use the Windows version of R-Studio to show the data recovery process, but these directions are fully applicable to the Mac and Linux versions of R-Studio. The panels and dialog boxes will have a different look and feel, but the functionality is the same. The main requirement to this computer is that it must have enough ports to connect several hard drives. The best way to connect the drives is to use SATA interfaces.
  • If you haven't already, download and install R-Studio. Right now, it is not necessary to buy and register the program. R-Studio in its demo mode allows you to perform all the necessary data recovery operations, except saving the recovered files. This lets you see if it can successfully recover your files and therefore, if it's worth buying. You will not have to re-install or restart R-Studio to register it.
  • Before you begin, prepare a storage place large enough to store all recovered files. It may be any disk visible by the operating system including an external or network drive.

Data Recovery Process:
1. Remove the drives from the NAS and connect it to a computer. Make sure the computer is powered off when you connect the drives, especially if you're using a SATA connection.

2. Start R-Studio and locate the NAS drives and RAID components.
NAS_Data_Recovery_01.png
Fig.5. RAIDs Components
Click image to enlarge

Before proceeding further, check the S.M.A.R.T. attributes for the NAS drives.

  • If the health status is CAUTION, there may be minor problems with the disk, but it should be safe to use the disk for data recovery purposes. The problems are likely to worsen, so check the S.M.A.R.T. parameters periodically to ensure that the health status hasn't gone to BAD. Creating an image of the disk is recommended, but this will require additional storage space.
  • If the health status is BAD, the disk conditions are critical and chances of hardware failure are high. The best recommendation for this case is to stop working with the disk and bring it to professional data recovery specialists. You may continue to work with the disk at your own risk, but disk imaging is very strongly recommended.

In our case, one disk is in the CAUTION state, but we can start data recovery while periodically checking the drive's conditions.

Data recovery from NAS Volume_2 (JBOD).
When Linux deletes files from an Ext4FS partition, it removes a lot of information about them. Usually, it's impossible to find the deleted files in the existing file system. We have to scan the partition.

1. Click the Scan button. The Scan dialog box will appear.
NAS_Data_Recovery_02.png
Fig.6. Disk Scan
Click image to enlarge
Click the Change button and leave only the Ext2/Ext3/Ext4 file system selected. Check the option "Save to File" and specify a save location. This will save your disk scan information, so you can resume where you left off if your disk scan is interrupted, or if you want to recover more files in another session. Check that the Extra search for Known File Types option is selected and click the Known File Types... button.

NAS_Data_Recovery_03.png
Fig.7. Known File Types
Click image to enlarge
Specify only those file types that you believe resided on the deleted disk. For our case, this is the JPEG image files. The best way to do that is to click the Clear button and then select the necessary types in the list.

Then click the OK button and return to the Scan dialog box. Click the Scan button.

R-Studio will start scanning the disk while showing the progress.

2. Inspect the scan results and find the scanned partition. In our case, it's I:(Recognized).
NAS_Data_Recovery_04.png
Fig.8. Scan Results
Click image to enlarge

3. Double-click the scanned partition and let R-Studio enumerate the files.
NAS_Data_Recovery_05.png
Fig.9. Found Files
Click image to enlarge

The deleted files can only be found by their file signatures. This method of data recovery is known as a "raw file recovery" or a "search for known file types." The folder structure, file name, timestamps, and other attributes cannot be recovered using this method.

R-Studio sorts files recovered from a raw file recovery according to their types and names and autogenerates a filename, such as 0265.docx. In some cases, R-Studio can attempt to recreate meaningful file names and timestamps from information and file attributes stored in the file's tags or metadata.

Please note that R-Studio uses slightly different icons to show deleted and existing files. You need to recover only deleted ones.

If you are searching for a particular file or set of files, you can use the advanced find and mark capabilities of R-Studio. See R-Studio help for more details: Searching for a File.

Use the built-in Previewer to estimate chances for successful data recovery. This is particularly useful with large picture files. Double-click a file to preview it.
NAS_Data_Recovery_06.png
Fig.10. File Preview
Click image to enlarge

In this test, we see that R-Studio was able to successfully recover files from Volume_2 (JBOD).

Data recovery from NAS Volume_1 (RAID5)
1. Create a RAID 5 and detect its parameters. Click the Create Virtual RAID button and select the Create Virtual Block RAID & Autodetect. Drag the necessary partitions to the Parents tab.
NAS_Data_Recovery_07.png
Fig.11. RAID5 Creation
Click image to enlarge

2. Click the Autodetect button. R-Studio will start detecting the RAID parameters. When it's done, click the Apply button.
NAS_Data_Recovery_08.png
Fig.12. Automatic RAID 5 Parameter Detection
Click image to enlarge

R-Studio will show the discovered partition.
NAS_Data_Recovery_09.png
Fig.13. Discovered partition
Click image to enlarge

3. Scan the partition and see the results:
NAS_Data_Recovery_10.png
Fig.14. Scanned partition
Click image to enlarge

4. Open the scanned partition Recognized1.
NAS_Data_Recovery_11.png
Fig.15. Scanned partition
Click image to enlarge
Note that even though R-Studio may show the deleted folder and its files, they cannot be recovered because they have a file size of zero.

The deleted files can be recovered only using file signatures.
NAS_Data_Recovery_12.png
Fig.16. Deleted files
Click image to enlarge
Once again, use the file icons to tell which file is deleted and which is existing.

5. Use file preview to estimate recovery chances.
NAS_Data_Recovery_13.png
Fig.17. File Preview
Click image to enlarge

6. Select the files you want to recover and choose a location to save the recovered files.
NAS_Data_Recovery_14.png
Fig.18. File Recovery
Click image to enlarge

If necessary, specify other recovery parameters. See R-Studio on-line help for details: Basic File Recovery. Then, click the Recover Marked button.

7. Do that for the other NAS volume.

When the recovery finishes, R-Studio will show a final report with the recovery results.
NAS_Data_Recovery_15.png
Fig.19. File Recovery Report
Click image to enlarge

Data recovery results
To view the recovered files, browse to the folder you selected in step 6 of the data recovery process.
NAS_Data_Recovery_16.png
Fig.20. File Recovery Results
Click image to enlarge

R-Studio was able to recover all files from the both NAS volumes. You will notice that some of the information about the original folder structure, file names, and other attributes was lost. However, R-Studio was able to assign meaningful names to the files using information from the remaining tags and attributes of the files.

Conclusions
As you can see from this demonstration, R-Studio can effectively recover data that was deleted from a NAS. In this example, we recovered data from an ext4FS NAS drive from a JBOD volume and a RAID5 volume. R-Studio's powerful virtual RAID capabilities allowed us to find the parameters and restore the RAID configuration after removing the drives from the NAS. This is a feature that you won't find in a free do-it-yourself data recovery program.

To see if R-Studio will be able to recover your files from a NAS device, you can use the Demo Mode and perform all the steps above except for saving the recovered files. Use the file previewer to estimate your chances of recovering the files you are looking for. If they appear correctly in the file previewer, you can register your copy of R-Studio on the fly and begin saving files immediately.

© Copyright 2000-2017 R-Tools Technology Inc.