Good encryption is not recoverable

If you set up something highly secure, you better have backup of it. Should it fail, more secure it is, more difficult it is to recover.

I have a QNAP NAS that had two large *.gho files (150GB – 200GB each) on a 1.5TB RAID Mirror 1 HDD.

These files are NOT Norton Ghost files but are True Crypt container files. I … managed to delete these two important files. I removed both HDD’s … in 20 secs of the deletion.

…. What do I do?

Nothing actually. If he’s really lucky, the EXT journal may still contain some leftover data; QNAP would use EXT3 or EXT4, both of them journal-enabled. If the journal does not have the original i-nodes, then TrueCrypt containers are no longer recoverable. The containers are specifically designed not to have any identifiable structure in them, or otherwise they would be breakable. Since there is no structure to work with, the fragments can’t be stitched together, and 150 GB is certainly larger than maximum practical limit for a contiguous file on EXT.

Network Recycle Bin and undelete

This specific question is about IX4-300d, but it applies to virtually any NAS out there.

The question is about some Recycle Bin equivalent for a NAS.

As in most NAS (if not all) when a file is deleted from a share in IX4-300d it disaappear “completely” from the drive. No chances to recover it from a Recycle bin. I read in a post that UNDELETE by Diskeeper might be a solution creating a “virtual” recycle bin. I decided to try it and downloaded a trail version of the program. But it did not recognized the drive/shares in the NAS. Does anyone has any experience with UNDELETE in NAS?

First of all, some NAS vendors provide an equivalent of the Windows Recycle Bin. QNAP, for example, calls this feature Network Recycle Bin. It keeps files retrievable as best practically possible (subject to age and free space constraints).

Whatever delete protection mechanisms, they must be implemented and run on the NAS side, because it is the NAS filesystem that owns the files and performs deletions. Any Windows-based installable recycle bin software only works with locally attached disks.

After the files are deleted with no Recycle Bin in place, there is still a chance – our Home NAS Recovery can help (with varying success depending on how long since the deletion).

QNAP and firmware problems

This topic on the QNAP forum provides multiple cases of the NAS failing after either a reboot, or a firmware upgrade. Some users hint to the firmware problem of some kind, but generally the descriptions are as follows

TS-409 lost configuration after reboot

I have a TS-409 (2.1.0 Build 0904T firmware) with 2x WD10EACS drives in RAID1. Following a reboot the device has dropped is showing as an unconfigured device. The drives are showing as ‘Invalid’…

I think that [updating firmware] may have caused this.

I have encountered similar problem with TS-409 QNAP version 2.1.0 (0624T) with 4 1 TB Seagate drives in RAID 5 configuration. All my settings are lost and the message says the server is not configured yet.

And then there is another topic on a similar, if not the same, issue

Suddenly TS-219P reports “Hard Drive Missing”, “Install and format at least one hard drive before using the NAS…”

Yesterday we installed an upgrade of the system software and added a user…

We don’t have any Linux computers, only Windows.

First of all, the basic sysadmin rule is if it is not broken, do not fix it. Once the NAS unit is assembled, configured, and filled with data, there is little, if any, need for firmware upgrades. Firmware upgrade in a NAS often involves rewrite of the entire operating system inside and migration of old settings to their corresponding last version equivalents. This does not always go smooth, so they warn you every time you’d better have backup before updating firmware.

If your unit has automatic firmware update, turn it off once you complete the initial setup.

However, once things start crashing around, we can still recover data with our Home NAS Recovery. Firmware update does not usually go around trashing actual file content on the disks. The configuration is lost, but this is something our software can handle.



QNAP and broken disks

This case highlights one quirk in QNAPs,

TS-212 disk2 in raid 1 replaced after failure won’t rebuild. ISSUE is that the second drive in raid 1 array failed and in degraded mode. Second drive is in an unmounted state and will not mount on it’s own or format.

original drives where:

disk1: Seagate ST3000DM001-1CH1CC24 – 2794.52GB

disk2: Seagate ST3000DM001-1CH1CC24 – 2794.52GB

disk2 failed so swapped disk2 for: WDC WD3000F9YZ-09N2001.0 – 2794.52GB

I tried the following commands [whatever]. always gets stuck saying

disk 2 is busy so it can’t add it to the raid 1 array.

Although the model is identified as TS-212, the problem affects many if not all QNAP models. If there is a disk  with bad sectors, the unit will sort of stall and will be not able to read any of the disks in it, or will read it very slowly, so that waiting for even simple operation to complete may be not worth it. Disk models, Seagate whatever or WD, are a red herring – QNAP may behave the same with a disk of any vendor if the disk has bad blocks on it.

The solution in this case is to shut down QNAP, remove disks one-by-one and clone them to a new disks, then re-insert disks into the QNAP and power it back on. Once there are no bad sectors on the disks, the recoveries/rebuilds usually proceed on their merry way.

I do not know the exact reason why this happens, but it may well be something associated with either the QNAP chipset or some quirk of the firmware.