Turbo NAS · TS · TVS · TS-h and TVS-h · rack · QTS and QuTS hero
Most QNAP faults leave your data untouched on partition 3 of each drive. What fails is the boot flash chip, the storage pool, a thin volume that ran out of room, or somebody's access through an internet-facing login: QNAP is the brand Qlocker and Deadbolt hit hardest. Power down, number the drives by bay, and do not run Check File System. We image every drive, rebuild the RAID group, the pool and the thin metadata from the images, repair the ext4 file system on the virtual volume, or import the QuTS hero ZFS pool read-only, and copy your files onto fresh media. A single-bay unit is £300 + VAT; a two-bay unit or any set is £500 + VAT upwards; four bays and above and rack units from £1,250 + VAT, in writing after the free look. 5–10 days at the bench for a set.
Rather talk it through? An engineer answers the bench line
0800 6890668
| Family | Models | Bays, OS, file system and layout |
|---|---|---|
| Home | TS-133, TS-231P, TS-251D, TS-264, TS-364 | 1–3 bays · QTS · ext4 |
| SMB desktop | TS-453D, TS-464, TS-473A, TS-873A, TVS-672XT | 4–8 bays · QTS · ext4 thick/thin |
| QuTS hero | TS-h686, TS-h973AX, TVS-h674, TVS-h1288X | 6–12 bays · ZFS |
| Rack | TS-873AU, TS-1273AU-RP, TS-h1683XU-RP | 8–16 bays · QTS or QuTS hero |
| DAS, not NAS | TR-004, TL-D800C | Expansion units; recovered as sets on the RAID site |
| What you see | The usual reason | Where that leaves you |
|---|---|---|
| Volume Unmounted / Not active | Pool not assembled or file system not mounted | No Check File System; imaged and assembled |
| Thin volume offline; pool at 100 per cent | Thin pool full | Thin metadata rebuilt from the images |
| Ransom page on the login; .deadbolt files | Deadbolt | Pull the cable; snapshots and untouched volumes |
| 7z archives with !!!READ_ME.txt | Qlocker | Deleted originals carved from the image |
| Pool or volume degraded | One member lost; still readable | Copy critical files; power down; no rebuild |
| Pool or volume crashed / unmounted / not active | Too many members lost, or file system damage | Every member imaged; assembled from the superblocks |
| Unit will not boot after an update | System partition or boot flash; data intact | Data arrays assembled without the OS |
| Drives shown as new in another unit | Foreign layout; the unit offers to install | Say no; the order is read from the metadata |
A case number goes on the parcel and a number on every drive the day it is opened, and an engineer settles what has actually happened before anything spins. The unit is examined on its own; each drive is assessed on our own equipment, never in a NAS that will try to rebuild. Back to you come two things together: a straight note of what is liftable and what is not, plus one figure, fixed and written down. Accept it, or decline and owe us nothing.
The box and the disks are two different jobs. The unit is tested separately, because a dead power supply, a failed board or a bricked boot flash leaves the drives untouched more often than not. Each drive is then read on the bench: the ones that answer at full speed, and the weak or failed ones in clean air where they need head work. On units that hold an encryption key or a layout of their own, the unit is part of the data and is kept with it.
Nothing is worked on live and nothing is rebuilt on the originals. Every drive in the set is imaged sector by sector, the weak ones head by head with the bad areas last, and the SSD cache with them where there is one. From then on the originals are not touched again.
Order, chunk size, parity rotation and the reshape point are read from the drives' own metadata and the array is reassembled in software: mdadm and LVM under SHR, X-RAID and QTS pools; a ZFS pool imported read-only; Drobo's BeyondRAID zones reconstructed. The file system, Btrfs, ext4, XFS or ZFS, is repaired on the virtual volume, and encrypted volumes are unlocked there with the key you supply. Never on the originals.
What was recovered is listed for you first, and only then does a bill exist. Approve the list and it is invoiced; turn it down and it is not — and where nothing has come back, most jobs carry no charge at all. Recovered data travels home on fresh media bought in for your job, with the postage at our end. Your case is not closed until you have opened the files on a machine of your own.
The network cable came out the moment the ransom page appeared. All four drives were imaged, the pool reassembled, and a snapshot from two days before the attack found beneath the encrypted volume. It was mounted from the image and copied out whole.
Illustrative example — replace with a genuine caseNot that we know of. What comes back is what Deadbolt did not reach: snapshots, deleted originals, partly encrypted large files, untouched volumes. The free look says how much.
No. The DOM flash carries QTS; your data is on partition 3 of each drive, and is assembled from images without QTS at all.
Yes. The pool is imported read-only from the images at the latest consistent transaction, and rolled back further where it must be.
No. It writes to a volume that may sit on a failing pool. Power down and send the set.
A single-bay unit is £300 + VAT; any set is £500 + VAT upwards; four bays and above and rack units from £1,250 + VAT.
Every drive imaged, the pool rebuilt from the images, and snapshots read where they exist. The first look is free.