Case Study | Data retrieval from the encrypted Buffalo Terastation NAS
Data extraction from the encrypted volume of Buffalo 8-Bay NAS TeraStation 5810DN
If your NAS data recovery attempt is diagnosed as a “dead end”, you would probably seek a second opinion to double-check the diagnosis. Even though we recommend choosing the right data recovery company the first time to prevent further damage to the storage media, we still encourage customers to send us their failed devices when competitors deem them unrecoverable. In many cases, ACE Data Recovery engineers have proven their expertise in retrieving data thought to be lost.
Network Attached Storage (NAS) Data Recovery Scenarios
Network Attached Storage (NAS) systems are a critical component of modern IT infrastructure. However, like all technology, they can fail in various ways. This essay will explore three typical scenarios related to NAS data recovery.
Scenario 1: NAS Server is Dead but HDDs are Good
When the NAS server fails but the hard disk drives (HDDs) are still functional, the primary challenge is accessing the data stored on the drives. The first step is to remove the HDDs from the failed NAS server. These drives can then be connected to a functioning system to access the data.
However, it's important to note that NAS systems often use specific file systems and RAID configurations. Specialized software or services may be required to interpret the data correctly. Always ensure to maintain the order of the drives as changing their order can lead to data corruption.
Scenario 2: NAS Server is Good but Multiple HDDs are Dead
In this scenario, the NAS server is functioning, but multiple HDDs have failed. This is a more complex situation as it involves dealing with potentially lost data.
NAS systems often use RAID configurations for data redundancy. If the RAID configuration allows for redundancy (such as RAID 5 or RAID 6), it may be possible to recover the data by replacing the failed drives and rebuilding the RAID array.
However, if the number of failed drives exceeds the redundancy limit of the RAID configuration, data recovery may not be possible without specialized services. In such cases, it's crucial to avoid writing new data to the remaining drives as it can overwrite the remnants of the lost data.
Scenario 3: NAS Server is Good, HDDs are Good but File System is Corrupted
A corrupted file system can render the data on the HDDs inaccessible, even if both the NAS server and the HDDs are functioning correctly. This is typically caused by issues like improper shutdowns, hardware faults, or NAS software glitches.
The first step in this scenario is to attempt a file system repair. This can often be done using the NAS server's built-in tools. If this is unsuccessful, specialized file system repair or data recovery software may be required. Hardware/software encryption adds another layer of complexity.
Prevention and Conclusion
In all these scenarios, the best prevention is regular backups. Having a recent backup can make the recovery process much simpler and faster, and can prevent data loss even in the worst-case scenarios.
In conclusion, NAS data recovery can be a complex process that depends heavily on the specific failure scenario. However, with careful handling of the hardware and the right tools, data recovery is often possible.
Buffalo TeraStation Major Setback
One of the biggest tax-focused American law firms, founded in Houston, Texas, suffered a failure of their Buffalo 8 Bay NAS TeraStation 5810DN. The NAS server housed decades of archived law cases, as well as some live case data for their current clients. This happened after a severe power outage – the TeraStation was unable to mount the file system data.
The client's Enterprise Support Engineer described the failure as follows: “The unit is generating a memory error message and we cannot get into our drives. The Buffalo unit encrypted the drives and the only way we can access our data is by repairing the memory error on the failed unit. The encryption is tied to the hardware.” The client had already sent this NAS to DriveSavers, Buffalo America's official data recovery provider, but DriveSavers was unable to extract the client's data.
The NAS Diagnosis
After a hardware inspection, ACE Data Recovery engineers found that all 8 TB WD Red hard drives were in good health. The NAS unit itself was also healthy – the problem was the NAS's inability to mount millions of files with the installed amount of memory, soldered to the motherboard.
According to Buffalo Americas, the TeraStation devices offer encryption at the entry level, including AES 256-bit strong encryption for the hard drives. The boot authentication feature prevents a stolen hard drive from unauthorized boot up. Even if the physical drives are removed from the unit, they cannot be read by a PC or on other TeraStation units.
TeraStation NAS Recovery Process
Our next step was a logical analysis. Our engineers found a way to virtualize the RAID and decrypt the entire virtual volume using the Buffalo decryption algorithm. This process was very time-consuming, so we had to custom configure special servers to speed up the process. After decryption was completed, we identified approximately 80 million files.
To transfer such a large number of files, we built a network configuration in our lab to write the client's data simultaneously to several return media, in the order defined by the client – current case information as high priority and archive files in the background.
The Takeaway
This multi-level recovery was extremely complex and time-consuming and couldn't be performed by just any data recovery firm. It required expertise in storage hardware, file systems, data layout, decryption techniques, and RAID reassembly. So, if you have to decide where to send your failed RAID, please think twice because not all data recovery companies are equal.