QNAP NAS Data Recovery: Drive Failure & Firmware Corruption

If your QNAP NAS just lost more than one drive at the same time, or QTS won't boot after an update, or your files all renamed to .deadbolt extensions overnight, do not let QNAP's web interface "fix" anything. Don't rebuild the array. Don't add a fresh drive. Don't click re-initialize. QNAP's QTS and QuTS hero are great at managing healthy systems and dangerous when things are already broken. Every helpful suggestion the GUI gives you during a crisis assumes the missing drive was an isolated failure. It usually isn't. Two drives dropping out together means a rebuild attempt will write new parity over the very sectors a lab needs to read.

Single drive failure in a healthy RAID 5 or RAID 6 setup? That's recoverable in place. Swap the drive, let QTS rebuild, done in a day or two. Two or more drives dropping out, RAID volume crashed, QTS bricked after firmware update, ransomware encrypted everything, or ZFS pool degraded on a QuTS hero unit? Power the NAS off. Pull every drive. Note which bay each came from. Then call a lab. This guide explains why, what we do that QTS can't, and what it costs.

What not to do right now (front-load)

This is the most important section if you're reading with a sick NAS sitting in front of you. The rest of the article is background. These are the four moves that turn fixable QNAP cases into unrecoverable ones, in order of how often customers make them.

The pattern these all share is writing to the drives. A failed NAS needs to be read, not written. Powering off and pulling the drives is the safest move. Slide each drive out, write the bay number on it with a piece of tape (Bay 1, Bay 2, Bay 3, Bay 4), and stop touching the unit. Drive order matters for reconstruction. Putting drives back in the wrong slots makes recovery harder.

If you've already done one of the things above, breathe. Stop now. Power the unit off. Most arrays we see have had a rebuild attempt before the owner called. We can usually still recover, the case just gets more expensive and the recovery rate drops.

Why QNAP arrays fail

QNAP makes solid hardware. The TS-453D in your office running for five years is a normal sight. When a unit does fail, the cause is rarely random. Patterns we see over and over again, in rough order of frequency:

All drives the same age and brand

The top cause of multi-drive failures. You populated a 4-bay or 8-bay QNAP with identical drives from the same batch, spun them up on the same day. Five years later, they start showing wear at the same time. One fails. While the array rebuilds, a second fails. Volume dies. Mix drive ages and brands when you rebuild.

QTS firmware upgrade brick

QNAP has shipped several major QTS releases that brick a percentage of older units on upgrade. The unit reboots into a recovery prompt, won't see the drives, or gets stuck in a "System Booting" loop. The data is fine. The firmware is the problem.

DeadBolt and other ransomware

QNAP units were hit hard by DeadBolt, Qlocker, eCh0raix, and several other ransomware families starting around 2021. The attackers exploit a vulnerability in QTS (often an outdated version with default ports exposed to the internet) to encrypt every file on the volume and demand a Bitcoin ransom. The drives are physically fine. The data is encrypted gibberish on disk. QNAP's official security advisory page lists each campaign and the patched QTS versions that fix the underlying vulnerabilities. We have a separate section below on what's possible with DeadBolt cases.

Power events

Lightning, brownouts, and dying UPS batteries kill NAS units in a specific way. Drives are usually fine. The QNAP controller takes the surge. Drives end up with parity inconsistencies because the system was mid-write when power dropped. On reboot, QTS sees the inconsistency and either refuses to mount the volume or tries to scrub it.

ZFS pool degradation (QuTS hero)

QuTS hero units run ZFS instead of ext4. ZFS is more robust against bit-rot but more fragile against multi-drive failures. A degraded ZFS pool with two drives showing checksum errors is a serious situation that QTS may show as "OK" until the third drive event triggers a full pool failure.

Static, thick, or thin volume corruption

QNAP supports three volume types: Static, Thick, and Thin. Thin volumes use copy-on-write that can corrupt badly when the pool hiccups. Thick volumes are simpler but waste space. Static volumes are the most predictable to recover.

NAS unit controller failure

Drives fine, QNAP unit dead. Power LED off, no fans, no beep. Or the unit powers on but can't talk to the drives. Some TS-series units have known capacitor and SATA controller failures we can rework. Faster route is usually to take the drives to the lab and reconstruct the array virtually without reviving the unit.

Wrong-bay hot swap

You see one red LED on Bay 3 and pull Bay 3. Turns out the failing drive was Bay 2, and your hot-swap killed the array. Always look at the QTS error log before pulling drives.

QTS vs QuTS hero, and what it means for recovery

QNAP ships two operating systems on its NAS units, and they handle storage very differently. Recovery looks different too.

QTS is the original QNAP OS. It uses ext4 on top of Linux mdadm software RAID, with LVM in the middle. This is the same underlying stack that Synology uses for SHR, just with QNAP-specific tooling on top. Recovery on QTS works the way most NAS recoveries work: image each drive, virtually reconstruct the mdadm array using metadata blocks, mount the ext4 filesystem, extract files.

QuTS hero is QNAP's ZFS-based OS, available on higher-end models like the TS-873A, TS-h1290FX, and most TVS-h series units. ZFS handles redundancy at the filesystem level, not the block level, so the recovery process is different. Image each drive, then reconstruct the ZFS pool using zpool import tools that don't trust the existing metadata. ZFS recoveries are harder when the pool is severely degraded because ZFS has more interdependent metadata than ext4. But ZFS is also more resilient to bit-rot in the steady state.

If you're not sure which OS your QNAP is running, log in to the web UI. The top-left logo says "QTS" or "QuTS hero" right under the QNAP wordmark. Or look at Control Panel, System, General Settings. Mid-range and home models almost always run QTS. Enterprise and prosumer units often run QuTS hero.

RAID levels on QNAP and recovery difficulty

QNAP supports almost every RAID level. Some are easier to recover than others. Here's the quick reference:

RAID 0 is a stripe with no redundancy. One drive failure means total data loss. We see customers who set up RAID 0 for performance and didn't realize there was no safety net. More on RAID 5 specifically here. RAID controller fundamentals here.

Failure scenarios we see most often

These are the QNAP recovery cases that come through the lab. Skim to whichever matches your situation.

One drive failed in a RAID 5 or RAID 6 array

The easy case. QTS shows one bay with a red LED. The volume is still mounted. Files are still accessible. You need to swap the failed drive and let QTS rebuild.

You don't need a lab for this. You need a replacement drive of equal or larger capacity. The trap to watch for is buying a drive from the same brand and batch as the original. Age-related failures often hit drives in batches. The rebuild puts maximum stress on the remaining drives, and that stress is when second drives often die.

Best practice: back up the current data to an external destination before swapping the drive. Yes, even though the array is still working. Many multi-drive failures happen during rebuilds.

Two or more drives failed in RAID 5

The volume is dead. QTS shows the storage pool as "Inactive" or "Crashed". Files are inaccessible. This is the most common QNAP recovery case we see.

What we do: image every drive sector by sector, including the failed ones. Failed drives often have most data intact and only specific bad sectors. Imaging a "failed" drive at the lab level recovers 90 to 100% of the sectors most of the time. Combined with the parity blocks on the still-working drives, we usually reconstruct the original volume. Order of operations: drives get cloned first, reconstruction happens against the clones. Original drives stay untouched. Same process we use for Synology arrays.

QTS firmware brick

You hit the firmware update button. Unit rebooted. Stuck on "System Booting" or won't see the drives. Drives are fine. QTS is the problem. Easy path: pull the drives, put them in a working QNAP of similar or newer generation, QTS offers to migrate. Hard path: migration fails, drives need to be imaged and array reconstructed in the lab.

Volume corruption after power loss

NAS was running, power went out, NAS came back up, volume won't mount or shows as read-only. Drives are fine. The filesystem (ext4 or ZFS) got caught mid-write and metadata is inconsistent. QTS will offer to "check and repair" the filesystem. Sometimes that works. Sometimes it makes things worse. Lab process: image drives, mount filesystem read-only with forensic tools, copy files off.

NAS unit dead, drives healthy

Power LED off, or LED on but unit beeping continuously, or LED on and fans spinning but no drives detected. The unit itself is dead.

Two paths. Path one: repair the unit at the component level. Some TS-series motherboards have known capacitor and SATA controller failures we can rework. Path two: skip the unit entirely. Image all the drives separately on lab hardware, reconstruct the array virtually, deliver the data on an external drive. Path two is faster and works regardless of how broken the unit is.

Wrong drive replaced

You saw a red light, pulled what you thought was the failing drive, slotted in a new one, QTS started rebuilding, volume is gone. The drive you pulled was fine. The rebuild started writing bad parity from the actual failed drive onto the new one. This case is recoverable most of the time. We image all the drives including the one you pulled, identify the real failure, and reconstruct from the correct combination. Caught within 30 minutes, usually fine. Rebuild completed before you noticed, data on the new drive is corrupted and we work from what's left.

QTS Says "Volume Degraded": What It Means and What Not to Do

"Degraded" is QTS telling you the volume is still alive but has lost its safety margin: one member drive of a RAID 1, 5, or 6 group has dropped out, and the array is now running with no redundancy (RAID 6 keeps one drive of margin after a single loss). Your files are still readable. What happens in the next few hours decides whether they stay that way.

The instinct is to slam a new drive in and let QTS rebuild immediately. That instinct kills arrays. A rebuild forces every surviving drive to read every sector it has, for hours or days. Drives in a QNAP were usually bought together and have aged together, so the survivors are the same age and wear as the one that just died. If any of them hits an unreadable sector mid-rebuild, the rebuild stalls or the array drops from degraded to crashed, and what began as an inconvenience becomes a recovery case.

Also check what QTS means by the warning: "Volume degraded" (a RAID member is out) is different from "Volume unmounted" or "Not active" (the file system or pool has already failed), and the safe responses differ. Storage & Snapshots shows which disk dropped and why; a disk with mounting reallocated sectors that got kicked once will usually get kicked again mid-rebuild. When the numbers look bad on more than one member, skip the rebuild entirely and image the drives first. The same degraded-volume math applies to Synology SHR, covered in our Synology NAS recovery guide.

DeadBolt and QNAP ransomware

QNAP has been a favored target for ransomware operators since around 2021. DeadBolt is the most famous, but Qlocker, eCh0raix, AgeLocker, and others have all hit QNAP units. The pattern is similar across all of them: attackers find an internet-exposed QTS instance with a known vulnerability, encrypt every file on the volume, and demand Bitcoin for a decryption key.

Here's the honest version of what's possible after a ransomware hit, and what isn't:

What's true about ransomware-encrypted data

The drives are physically fine. The data on the drives is encrypted ciphertext, but the underlying blocks are intact. Imaging the drives at a lab preserves the encrypted data exactly as the attacker left it. This matters because, occasionally, security researchers or law enforcement release decryptors for specific ransomware families. If we image your drives now, you can use a future decryptor later without re-encountering whatever vulnerability got you hit the first time.

What's NOT true about ransomware

No lab can brute-force decrypt the files. Modern ransomware uses AES-256 with random per-victim keys. The math says brute force takes longer than the universe will exist. If anyone tells you they can decrypt your DeadBolt files without the key, they're either lying or they're a scammer who plans to take your money and disappear.

Your actual options after a ransomware hit

In order of what we recommend:

1. Restore from backups. Hyper Backup, USB backup, cloud backup, off-site backup. If any of these exist and predate the attack, restore from them. This is the only path that gets your data back today.
2. Image the drives for the future. We can image all drives and store the encrypted data on an external drive. If a decryptor releases later, you can decrypt the imaged data. If one never releases, you've spent a few hundred dollars on insurance that didn't pan out.
3. Pay the ransom. We do not advise this. The FBI and the broader security community discourage paying. Sometimes attackers don't deliver keys after payment. Sometimes the keys don't actually work. Sometimes paying triggers a second extortion attempt. If you pay, the operation that hit you continues hitting other people. Some businesses do pay anyway because the data is worth it to them. That decision is yours alone, and we won't help you negotiate or pay.

The right time to defend against ransomware is before it happens. Disable internet-facing QTS access. Use a VPN to reach the NAS remotely instead. Keep QTS firmware current. Set up Hyper Backup to an offline destination (USB drive that gets disconnected after backups, or a cloud service with versioning). Once ransomware hits, the options narrow fast. Our business ransomware response guide has more detail on the immediate steps.

How a real QNAP recovery works in the lab

NAS recovery differs from single-drive recovery in one big way: there are multiple drives that have to be coordinated. Here's what actually happens after the unit arrives, in order.

Models we recover from

Every QNAP model. QTS and QuTS hero. RAID 0/1/5/6/10/50/60. ext4 and ZFS. Rackmount and desktop. Single-bay through enterprise.

We also handle the HS, IS, TS-h, and TVS-h enterprise lines. If you've got a QNAP, we can work with it. Our main NAS recovery page covers other brands too.

Honest pricing

QNAP recovery costs more than single-drive recovery because there are more drives to image and array reconstruction takes more time. Here's what to expect, with no fake "starting at" numbers.

Two things to know about pricing. First, the price is for the actual recovery, not a deposit. If we can't recover, you owe nothing. Second, the range exists because we don't know the full damage until we image the drives. We won't quote $1,200 over the phone and then surprise you with $3,000 once the drives are in our hands. Our full pricing page shows ranges for every recovery type.

When recovery actually isn't possible

Honest version. Here's the list of situations where the data is genuinely gone and no lab can help.

• Four or more drives in a 4-bay array all failed at the same time with significant media damage. The math doesn't work. Each drive might recover 90% of sectors, but the missing 10% overlaps across drives in ways that destroy entire files.
• RAID 6 or RAID-Z2 with three or more simultaneous drive failures. Same math problem.
• Array re-initialized through QTS after the failure. Initialize wipes partition tables and storage pool headers. Recovery rate drops dramatically.
• Drives physically destroyed. Cracked platters, melted chips, severe burn damage. If the magnetic surface is gone, the data on it is gone.
• Encryption with lost passphrase. QTS supports volume-level encryption. If you lost the key and the volume is encrypted, recovered files will be unreadable ciphertext.
• DeadBolt or other ransomware where no decryptor exists and no backups survived. The data is encrypted on the drives, the drives are fine, but without the key the data stays encrypted.

If you're not sure which bucket you fall into, call us. We'll tell you within 10 minutes whether it's worth pursuing. We don't take cases we know are hopeless. The "no data, no charge" promise depends on us being honest about what's possible.

Real lab footage

What hard drive recovery looks like inside the cleanroom. This is what happens when a NAS drive shows up with head damage from heat or age. The same process applies to QNAP drives.

Why waiting makes QNAP recoveries worse

A degraded QNAP array is a ticking clock. Every day the volume stays half-broken, the surviving drives keep working under stress. The right move when an array goes degraded is either fix it within days, or power it off entirely until you have a plan. The wrong move is to let it limp along. We've seen customers wait two weeks with a degraded array, only to have a second drive die during that window and turn a $1,500 recovery into a $3,500 one. If you can't act this week, power the unit off and store the drives somewhere safe.

FAQ

Can QNAP recover my data themselves?

Should I let QTS rebuild the array if one drive failed?

My TS-453D shows the volume as "Inactive." Can I still recover?

How long does QNAP NAS data recovery take?

Can you decrypt my DeadBolt files?

Should I pay the ransomware ransom?

Do I need to ship the whole NAS unit or just the drives?

What if I already tried to rebuild and made things worse?

My QNAP unit died but the drives seem fine. Can I put them in a new QNAP?

Is my Hyper Backup file useful if the main NAS died?

Where are you located, and can I drop the drives off?

Do you work with businesses needing compliance documentation?