Recover Deleted Files From A QNAP NAS
There is little worse than having lost data. Nothing can prepare you for what needs to be done – so it’s always good to have options. When presented with catastrophic data loss on a customer’s QNAP NAS device (that had no second copy), I had to work fast and try to recover as much data as possible. My attempt at a restore started from this post in QNAP’s forum and expanded into the steps you see here.
Briefly: I’ll take you through the steps required to download, install and run a recovery application on a QNAP NAS device. You’ll be able to recover the entire RAID partition or deleted files (found in free space on the drive).
Some Important Notes:
– Stop READING or WRITING to the NAS as soon as you can. Stop backups (temporarily) that write to the NAS. No changes mean you’ll get more files.
– This stuff takes a nasty long-ass amount of time, be ready to pull up a chair or possibly a cot
– Do yourself a favor and find the fastest interface of external drive possible. USB 2.0 will be allot slower than an eSata external drive.
– QNAP (in more recent firmware releases) has a Network Recycle Bin feature – having that enabled may prevent this sort of thing.
– This example is run on a QNAP TS-659 Pro, your mileage may vary. I’ve found QNAP NAS devices to be good performers and have a great flexibility of options.
1. Connect an external drive
First, get an external drive connected to the NAS. In my experience external drives “Docks” don’t work as well as simple enclosures. QNAP also has a compatibility list for each NAS device on their site (here’s the one I’ve been working from).
As an example of how tricky this can be: My first attempt was with a Vantec NexStar NST-D100SU external drive dock. The NAS didn’t recognize the drive in this at all. I then connected a Lacie 2TB Porsche Design P’9231 drive to the NAS and it only detected a 620MB drive (not the 2TB, I expected). I then picked up a Western Digital My Book Live 2 TB drive, connected it and saw the full 2TB. Both are USB 2, and as “close to” compatible as I could find.
You may not find the exact same thing, but if you look for something in the same brand or similar type range as this, you’ll be better off than just a random external drive enclosure.
Connect the drive and make sure you see in the administration web front-end (usually in the menu under -> External Drive –> External Storage Device. When your QNAP NAS recognizes this drive, it will be listed as USBdisk1.
Once connected, format this drive EXT4 using the entire drive’s space. pay attention to that space because it will need to cover all of the space you’re trying to recover. Once that is done, your new drive will be mounted as the share USBdisk1 – What I do is use the share admin tool in the web admin to make sure I have access to read and write files in that share.
2. Get the recovery software
You’ll need an application to run the recovery process with. This is called PhotoRec and it comes in the TestDisk package. You can download it here. I used the Linux i386 version shown at left. This is going to run locally on your QNAP NAS device. Once you have that compressed file, create a directory
3. Get an SSH tool and connect
If you’re running Windows (in my case I am), go grab the tool called Putty (download here) which will let you connect to a secure shell of your NAS device. Using a Mac? You’ll do this with the Terminal application. Once you’re ready, connect to the NAS’s IP using SSH and the admin login and password for the NAS (if I recall, QNAP’s defaults are a user of admin and password of admin).
4. Run the recovery
This one takes several sub-steps, and will all happen in your SSH window.
- Change (cd) to the folder where you’ve stored the files downloaded in step 2. In may case I had them in /USBdisk1/rec – so I changed to that directory.
- Raise the permissions of the recovery tool (chmod), you just want to run it, so as a quick way to get going, give everything 777 permissions (chmod 777 *).
- Run PhotoRec (photorec_static) in the shell by issuing a ./photorec_static command
- PhotoRec: If you’re ask to create a log file, say yes
- You’ll see a huge list of drives, you’ll want to move down to highlight the /dev/md0 – which would likely be your RAID Drive. Once highlighted, move your cursor down to “Proceed” and press enter.
- If you’ve lost the partition, PhotoRec will ask you to describe it (I would choose the defaults). In my case, this part didn’t come up.
- Next, your going to see a screen that gives you the choice of partition or whole disk. Highlight the partition and then move the cursor to file opt. This is important because you’ll be able to choose different file types that you want the application to search through. This will also help if you’re external drive isn’t completely as big as you want it to be.
- Next, select the EXT3/EXT4/… file system
- Then, choose to look at free space (good for mistakenly deleted files) or the whole partition, likely better for a corrupted volume. In my case I was looking through free space.
- The next screen will ask you where to put the extracted files – MAKE SURE you aren’t placing them on the NAS, use (in out example) /share/USBdisk1
- Now, your ready to proceed. All goes well, this process will start creating files on your recently connected USB disk. Run times will vary, but as you see below, I’m looking at 7 more hours.
When files start coming out, PhotoRec will start creating directories with 500 files each in the location you selected. They’ll start looking like this:
The trouble is, you won’t be able to determine the file name for most of them or the content. So, one method I’ve seen mentioned is to place them in a document indexer (Like Microsoft Search) and use that to search details and content of the files.
So, that’s the story. This doesn’t take into account the process of a full drive restore or using other tools. For further reading, take a look at this forum topic on QNAP’s website. The author’s inspired my attempt at recovering using this method, and ultimately this article.