Taking work now — the first look is freeNAS drives posted in from anywhere in the UK, or handed in at ten drop-off pointsQuicker still, give us a ring:0800 6890668
NDRNAS Data Recovery 0800 6890668 Price my job
NDR / Every kind of NAS / Encrypted volumes and folders

Synology encrypted volume · eCryptfs shared folders · QNAP LUKS · Asustor · TrueNAS

Encrypted NAS volumes and folders. We bring the array. You bring the key.

Encryption on a NAS comes in two shapes. Synology's encrypted shared folders, Asustor's folder encryption and QNAP's older folder encryption wrap individual files with eCryptfs, so that a rebuilt volume shows scrambled filenames until the folder's key or password is applied. Synology's encrypted volumes from DSM 7.2, QNAP's and TerraMaster's volume encryption and TrueNAS's dataset encryption use LUKS or ZFS's own encryption over the whole volume, unlocked by a passphrase, a key file, or a key vault on the unit's system partition. In every case the array is reconstructed exactly as an unencrypted one would be, and the unlocking happens on the image with the key you supply. We do not break encryption, and without the key there is no recovery, which we say at the free look and not after. A set is £500 + VAT upwards, fixed in writing, 5–10 days at the bench.

Free first lookOne fixed figure in writingNo data, no bill on most jobsReturn postage paid

Rather talk it through? An engineer answers the bench line
0800 6890668

Power it down. Label each drive with its bay number. Do not rebuild, repair, initialise, reinstall or reset. A rebuild reads every sector of every surviving drive, and on a set with a second weak member it finishes what the first failure began. Nothing on the drives gets worse while the unit is off.

Encrypted NAS symptoms, and what each means.

Not listed? Describe it on the form →
Encrypted folder will not mount after a repairThe volume beneath it was rebuilt wrongly, or the key is missing.Do not delay
Volume shows locked and the vault is goneThe key vault was on the system partition that failed or was reinstalled.Do not delay
Filenames are scrambled on a rebuilt volumeThat is eCryptfs; the folder key unlocks it.Everyday job
The unit was reset or DSM reinstalledThe vault may have gone with the system partition. Do not do anything else.Do not delay
Key file exported; passphrase forgottenThe key file is enough.Everyday job
Packing it and posting it: power the unit down, write the bay number on each drive with a marker before it comes out, and send every drive from the set, including any SSD cache. Each drive travels in an anti-static bag inside its own padding, in a box with nothing able to move; the unit itself comes too if it holds an encryption key or a proprietary layout, and its power supply with it. Insure the parcel for what the files are worth rather than the price of the drives, and use a tracked service. The posting address is not printed anywhere on this site; it arrives by email in reply to the form, with a booking sheet to print; the sheet inside the parcel is what matches it to your enquiry when it is opened. Or hand the sealed parcel in at the nearest of ten drop-off points, your name on the outside and the sheet inside; say where you are on the form and it comes by email. We pay the postage home either way. The whole of it is written up on the guide to packing and posting.

How it is laid out, and what fails.

Synology encrypted shared folderseCryptfs over each folder, unlocked with the folder's password or the .key file you exported. The volume beneath is rebuilt as normal; the folder is mounted from the image with the key.
Synology encrypted volumes, DSM 7.2 onwardsLUKS over the whole volume, with the key held in an Encryption Key Vault on the system partition or on a KMIP server. A system partition that is intact can unlock the volume; one that was reinstalled cannot, unless the recovery key was saved.
QNAP, TerraMaster, AsustorLUKS volume encryption on QNAP and TerraMaster, unlocked by password or the exported key; folder-based encryption on Asustor with a key the user cannot change.
TrueNAS and ZFSNative dataset encryption with a passphrase or a key file, or legacy GELI under FreeNAS. The pool imports; the datasets unlock with the key.

What it says, and what it means.

Describe yours to us →
What you see The usual reason for it Where that leaves you
Encrypted folder: mount failedVolume damage beneath, or key missingVolume rebuilt; folder unlocked on the image
Volume locked; Encryption Key Vault unavailableThe vault was on a lost system partitionRecovery key needed; the unit examined for the vault
Scrambled filenameseCryptfs seen without its keyKey applied on the image
LUKS: no key available with this passphraseWrong passphrase, or a damaged headerHeader backup used if one exists; passphrase required
ZFS: key not loadedDataset encryptionKey or passphrase loaded on the imported pool

From the box arriving to your files going back.

Work we have closed →
01

Logged the day it lands, and the first look costs nothing Free

A case number goes on the parcel and a number on every drive the day it is opened, and an engineer settles what has actually happened before anything spins. The unit is examined on its own; each drive is assessed on our own equipment, never in a NAS that will try to rebuild. Back to you come two things together: a straight note of what is liftable and what is not, plus one figure, fixed and written down. Accept it, or decline and owe us nothing.

Nothing to pay for lookingA single figure, put in writingNo rebuilds, no repairs, no resets
02

The unit, and the drives, apart

The box and the disks are two different jobs. The unit is tested separately, because a dead power supply, a failed board or a bricked boot flash leaves the drives untouched more often than not. Each drive is then read on the bench: the ones that answer at full speed, and the weak or failed ones in clean air where they need head work. On units that hold an encryption key or a layout of their own, the unit is part of the data and is kept with it.

Unit and disks assessed separatelyFailing members to the clean bench
03

Every member imaged, once

The array is reconstructed from the images exactly as an unencrypted set would be. The encrypted volume or folder is then unlocked on the virtual volume with the key you supply: the passphrase, the exported key file, the vault read from the unit's system partition, or the KMIP details. Nothing is attempted on the originals, and nothing is attempted without the key.

Every drive, including the cacheWeak areas last
04

The set put back together, from the images

Order, chunk size, parity rotation and the reshape point are read from the drives' own metadata and the array is reassembled in software: mdadm and LVM under SHR, X-RAID and QTS pools; a ZFS pool imported read-only; Drobo's BeyondRAID zones reconstructed. The file system, Btrfs, ext4, XFS or ZFS, is repaired on the virtual volume, and encrypted volumes are unlocked there with the key you supply. Never on the originals.

Rebuilt in software, from imagesThe file system repaired on the virtual volume
05

You see the file list before you pay

What was recovered is listed for you first, and only then does a bill exist. Approve the list and it is invoiced; turn it down and it is not — and where nothing has come back, most jobs carry no charge at all. Recovered data travels home on fresh media bought in for your job, with the postage at our end. Your case is not closed until you have opened the files on a machine of your own.

No charge until you accept the figureFresh media, supplied with the job5–10 days at the bench

What arrives most often

  • Find the key before you post. The folder password, the exported .key file, the volume recovery key, the KMIP server details. Ten minutes now saves a week later.
  • Send the unit. On a Synology encrypted volume the key vault lives on the system partition across the drives and the unit's configuration; a reinstalled DSM is a lost vault unless the recovery key was saved.
  • We do not break encryption, and we decline devices that are not yours to open. A NAS belonging to an employer or an estate needs the owner's written authority.
  • Encryption adds a step, not usually a cost, provided the key is to hand. The array work is the same.

One job, followed all the way through.

UK · NDR-2026-0538JOB LOGGED ✓

A Synology DS923+ with an encrypted volume, a crashed pool, and a recovery key in a password manager

Two drives had failed in SHR and the pool read crashed. The owner had saved the volume's recovery key when it was created, which decided the job. All four drives were imaged, the SHR arrays and LVM volume reassembled, the LUKS volume unlocked on the image with the recovery key, and the Btrfs file system mounted from it. Everything came back.

100% of it recovered7 days here, and back by post
Illustrative example — replace with a genuine case

What helps, and what harms.

Do this much first

  • Find the passphrase, the exported key or the recovery key first
  • Power down and label the bays
  • Send the unit with the drives
  • Have the owner's written authority if the NAS is not yours

What sets us back

  • Reinstalling DSM or QTS, which can take the key vault with it
  • Resetting the unit
  • Guessing passphrases repeatedly on a keyed volume
  • Removing the encryption on a failing volume

Questions answered before you commit.

I have lost the password to my encrypted shared folder. Can you get in?

No. We do not break encryption. If you exported the folder's key file when you created it, that unlocks it; otherwise the data is out of reach, and we say so at the free look at no charge.

My Synology was reinstalled and the encrypted volume is locked. Is it gone?

If you saved the volume's recovery key, no. If the key lived only in the vault on the system partition that was reinstalled, the bench examines the unit for what survives, and is honest about the odds.

Does encryption make the recovery more expensive?

Not usually. The array work is the same; the unlocking is a step on the image once the key is supplied.

What does it cost?

A set is £500 + VAT upwards after the free look, fixed in writing; a single-drive encrypted unit is £300 + VAT.

How long does it take?

5–10 days at the bench.

Begin here if yours is doing the same thing.

Synology system partition failed →Synology →QNAP →TrueNAS / FreeNAS →Four-bay RAID 5 and 6 →

Find the key. Then send the set.

The array is rebuilt from the images and unlocked with what you supply. The first look is free, and the figure is in writing before any chargeable work.

0800 6890668

Price my jobPacking and posting