The bench is open for new cases · Mon–Fri, 9am–5:30pm Need it fast? Ring 0800 6890668
EDR Exeter Data Recovery 0800 6890668 Start my case
EDR / Specialist / Synology NAS recovery

Specialist · Synology recovery

Synology recovery for Exeter. “Volume Crashed” is DSM giving up; the data beneath sits where it always did.

One red banner on an Exeter DiskStation, but three completely separate problems lurking beneath: RAID members missing; LVM metadata scattered everywhere; or a btrfs tree that no longer balances. DSM will display them all as the same problem, though they each require their own solution, and attempting to solve for the wrong issue will make it even worse. So until someone can actually read the data off the disks, there is simply one safe option: shut the box down and do not touch the Repair button.

Only pay if we recover your data, on most jobs Free diagnosis and a written quote Get a quote first, then post from anywhere in Devon

Talk it over with an engineer
0800 6890668

What the symptoms on a Synology are telling you.

Not there? Head for the triage →
What's wrongWhat it usually meansStep one
Volume Crashed, according to DSM.Only one error message, but there are really three suspects: btrfs, LVM, RAID.Shut off power. Don’t attempt a Repair.
Storage Pool shows Degraded status.One disk is missing: all functionality remains, except for redundancy.Time is now working against you.
The DiskStation itself will not boot.Nothing has moved: the data resides on the hard disk drives; it was never stored within the device.One of the milder faults.
Started rebuilding its contents onto a different hard disk, but did so only partially.The heavy reading from the rebuild showed there was a second tired diskStop at this point. Imaging comes before rebuilding.
A PC is now offering to format the NAS drivesThat is to be expected, since the way Linux organises its storage space means nothing to Windows.Say no, every time!
Your shares have been replaced with a ransom demand.A strain which attacks internet-accessible NAS devices.Take a picture of this, turn it off, then take a look at the ransomware page.
Posting it to us: get a quote first, by phone or with the form, then please use a traceable (tracked) and insured postal delivery method to send your device to our intake lab in Bristol; the return is paid for by us. Alternatively you can drop your item off there yourself, Monday to Friday, 9am to 5:30pm, with no appointment needed. An engineer will talk you through how to pack your unit when you call to obtain the quote. More information about sending your items can be found on the contact page.

Inside SHR — and why generic tools come up empty.

Carved into slicesSHR will divide each drive into portions based on the size of the smallest drive. So while it wastes nothing when mixing different capacity hard drives, it also has the result of having all the data in one volume spread across multiple separate arrays.
Ordinary parts, unusual stackingEach layer is standard stock Linux (mdadm with the slice pieces set together, LVM binding those into one common pool, and then ext4 or btrfs on top). Thus, recovery can take place without needing a Synology box at all; rather, we need to dismantle this stack in exact order.
Where one-array software gives upWith four different size disks put into SHR-1, underneath that there are either three or four mdadm arrays sitting within one LVM pool. If software is looking for a single flat array, it has nothing to lock onto.
The two 'fixes' we rule outDSM's Repair option, with its ability to discard good members and trample metadata in the event of disk failure, as well as the btrfs repair tool that has its own warnings about destroying a damaged tree. However, in this lab neither is run, since everything will be built as read-only using the images.

The recovery, one stage at a time.

01

Booked in, assessed for nothing Free

Your device will be logged under its own case number on the day it comes into our lab. The engineer who works on your device identifies the problem with it, clearly states what we think has a good chance of coming back and provides you with one fixed quote. There are no charges for this assessment; there is no obligation for you to do anything; and paid work does not begin until you authorise us to start.

The look is freeA single quote, in writingNo obligation
02

Image every member, touch nothing

A sector-mapped image of each drive is taken prior to anything else happening. The box remains powered down (so no rebuild can restart) and the older btrfs roots remain intact, exactly as the failure left them.

Each drive imagedOld tree roots preserved
03

Unpick the stack, layer by layer

Every single step is done on the images: all partition slices are identified, the arrays built by mdadm are put back together, the data from LVM is decoded and then the btrfs or ext4 volume is brought up read-only. Here, order makes a difference, so we follow it.

Slices → arrays → filesystemNothing mounted writable
04

Treat the layer that broke

Regardless of which layer failed (RAID, LVM or btrfs), we repair using the rebuilt copy and never touch the originals. If the current btrfs tree has been destroyed, we use one of the previous healthy generations instead, then go into each of the shares, open them and check them.

The broken layer mendedEvery share verified
05

Watched back, verified, returned

You have access to a complete list of every item recovered from your device, which you approve prior to any fees being applied. The files will be returned via new media (brand new) with the return postage paid by us, and the case remains open for as long as it takes to confirm that all the files open properly on your own machine.

You approve the file listReturned on new mediaWe pay return postage

Opening checks at the bench

  • The banner does not indicate the source of the problem: Volume Crashed covers a damaged btrfs file system tree, loss of LVM metadata or failure of an mdadm RAID member alike. It is only when each layer is read separately from the hard disk drives that you will know which one you are dealing with.
  • Copy-on-write leaves a trail home: because btrfs does not write over the same area where data previously existed, the old tree roots typically remain intact on the disk. Thus, when the latest tree declares that a volume is dead, going back one generation will often restore that volume to life.
  • That Repair button has ruined jobs: if you use it while the pool is failing, you could potentially remove healthy components of the array and overwrite the evidence needed for successful recovery. A good time to press this button is after you know the RAID is stable and working properly. In other words, do not press this button when the pool has crashed.
  • Ransomware finds the reachable, not the unlucky: the reason all major ransomware attacks on NAS devices have targeted the same type of device is that all of them were exposed to the public internet, running old firmware. Remove your NAS box from the world wide web, always keep DSM updated, and you will have shut the main door that ransomware attackers use to access your data.

The deciding factor for these cases is: if you are using different disk size combinations under SHR, then instead of having one array you will have multiple mdadm arrays spread out over slices of each disk, and LVM will create a single file system from those. Approach this stack in the wrong order and nothing appears; when you disassemble it correctly, you usually find that what looks like a 'crashed' volume has all the data still present.

Fresh from the casebook.

EX · EDR-2026-2857VERIFIED ✓

Four mismatched disks in a DS unit, undone by its own good intentions

Two 4TB hard drives, two 8TB, one member dead, and by morning, after rebuilding, that DSM array had ended in Volume Crashed. It turned out to be three mdadm arrays under the hood: two of which were fine; the third was working but degraded. So we put them back together outside of the box, we stepped the btrfs tree back one generation, and all shares came back.

All shares restored5 days in the lab

Before it leaves your hands.

Do

  • Turn off the power as soon as "Crashed" or "Degraded" shows up in the interface
  • Mark where each drive comes from with labels for each bay.
  • Get a price quote first. Then send the bare hard drives, labelled by bay number and untouched, or the whole NAS if they won't come out.
  • State the configuration (SHR) or layout (plain RAID), if known.

Steer clear

  • Hit the "Repair" button while there is a degraded or crashed volume.
  • Aim any btrfs repair commands towards the original disks.
  • Agree to a PC's initialisation request for your disks.
  • Try swapping out each disk among bays to identify which has failed.

Straight answers from the bench.

DSM says 'Volume Crashed' — is the data gone?

Very rarely. A volume that has "crashed" simply means DSM was unable to reconstruct the disk stack: missing RAID member(s), damaged LVM metadata, or a damaged btrfs tree. These are three different failure cases, and most are repairable, but no message will tell you which one happened to you. As long as the box remains powered down, all routes remain available.

SHR — is it proprietary, and would I need another Synology to read it?

No. Remove all branding from the product and you have SHR, which is standard Linux: mdadm software RAID which is constructed out of partition slices, LVM pools those together, then a filesystem (btrfs or ext4) is created on top. Given the drives have good images, it would reassemble using a common workstation. Problems only arise if some tools or people expect there to be one single flat array.

Is letting DSM rebuild onto a new disk safe?

Only once each of your member disks has been successfully captured as an image. Rebuilding runs through those worn survivor disks end to end, exactly what will finish off another disk under heavy use, and there's a chance it could be overwriting some of the older file system structure a recovery depends upon. So with the capture process completed first, there is no risk of damage during the rebuild process.

Ransomware got into the NAS — is anything left?

Usually some of it, and sometimes you may be lucky enough to recover all your files: that depends on the type of ransomware strain. For years now, many internet-facing NAS devices have been attacked, so the search can include older snapshots, replication copies, as well as whatever remains in free space. Once you take a picture of the ransom note and turn off the unit, follow through with the directions on our ransomware page regarding which routes are best to pursue.

More like this in the casebook.

NAS boxes → RAID 5 arrays → Hit by ransomware → What we take in →

Whatever the fault, leave the power off.

Every time a failing hardware component is powered back up, there is additional lost data. First open a case with us: the inspection (look over) is always at no cost, whichever way it goes.

0800 6890668

Get a free diagnosis Sending a device in