Terastation Recovery

From NAS-Central Buffalo - The Linkstation Wiki
Jump to: navigation, search


Nuvola apps important.png 

The steps described in this article can lead to data loss if things go wrong. If your data is critical to you you should first attempt to recover the data


This article is about recovering TeraStation systems that are failing to load correctly to get them back to a working state

Before attempting to do any of the articles described in this article you want to first read the wiki article on Terastation Data Recovery.

It covers several types of failures:

  • A single disk fails
  • Failures to start the boot process
  • The system fails to complete the boot process
  • The system appears to boot OK, but the Web GUI and File Shares are inaccessible.

Systems Covered

The systems that are currently covered by this article include all the original PPC based Models:

  • Original TeraStation
  • TeraStation Home Server
  • TeraStation Pro v1

The following ARM based systems are not currently covered:

  • Terastation Live
  • TeraStation Pro v2

Booting Process

To understand the recovery processes that are described here it is very advantageous to have an understanding of how the boot process works.

It runs in various stages:

  • A boot loader is loaded from flash
  • The boot loader now runs a Linux kernel and a very basic Linux system from disk, with the system files being run from a RAM disk. The disk arrays are started.
  • The Linux kernel is switched to running from the System area (partition 1) of the hard disk.
  • The system services such as Samba file sharing, the Buffalo Web GUI and (if relevant) File Transfer service, Printer Service, Telnet and the Media server services are started.

Failures can occur at any of these stages and the recovery process to be followed will be dependent on identifying at which stage the boot process failed.

Failure Symptoms

The Original and the Home Server TeraStations report problems by lighting up a Red DIAG light. This light then flashes a number of times to indicate the type of problem detected.

The TeraStation Pro v1 has a LED display instead, and if problems are encountered it displays a Exx type error code.

If the system fails almost immediately it normally means that there is a flash based problem. These are by far the hardest to recover from.

If the system fails after around 30 seconds or more into the Booting process, then this normally means that there is a problem with the System area on the Hard Disks. This type of problem should almost always be recoverable as long as one is very careful about the steps that are carried out.

It is also possible for a single disk to fail. If you are using a RAID5 or a RAID1 array then this situation can be recovered without losing any user data. This is described in the section on replacing a single drive

Sometimes a drive failure (like the circuit board of a hard drive failing) can lock up the IDE bus. This leads to a non-booting terastation. If your TeraStation just blinks 6 times (HDD failure) this could be the reason, connect the disks to a PC one by one to find the failed one and replace it.

Replacing the Hard Disks

This section covers using Hard Disks of up to 500Gb which is the maximum size supported by the standard Buffalo software on the PPC based TeraStations. If you want to try and use disks that are larger than this size look at the article on TeraStation and Large Hard Disks.

Replacing a Single disk in a RAID5 array

If a single disk has failed in a RAID5 array, then the system can be recovered without reasonably easily without any data loss. On the Original and Home servermodels a disk failure is indicated by the Disk Status light turning Red. Note that this light is also used to indicate a Disk Full status (more than 90% of disk used) so if all disk Status lights turn Red this is almost certainly the reason. At this point the TeraStation will continue to operate normally, and if you go into the Web GUI you will be told that one or more of the disk arrays have "Low Disk Space". If a disk has failed then you will be told that instead.

The first thing is to decide if the disk really has failed - or whether some sort of data corruption has made the TeraStation think that the drive has failed. Spurious reports of disk failures seem to be quite frequent, and are particularily likely to happen after a power failure. The best way to do this is to attach the drive to a PC and run the manufacturer's disk diagnostic software to check the drive. If this is not possible, then you can simply clear down that drive and see if the disk comes back to life.

Preparing a Drive

There are a few things you need to check before attempting to use a drive:

  • If you have a new drive and it is IDE based is to ensure that the jumpers are set correctly. Most new drives come with the jumpers set for the drive to operate in "Slave" mode on the assumption that they are being added to a working PC. The TeraStation requires that the drive be set to operate in Single/Master mode. There should be a digram on the drive showing what the correct jumper setting are for the different modes of working. For SATA drives as used in the TeraStation Pro this is not an issue.
  • Removing any existing partitions. Most new drives come without any partitions and would probably work immediately. However some manufacturers try to be "helpful" and provide their drives already partitioned and formatted. If you have a drive in this state (or you are trying to re-use a previously used drive) these partitions need to be removed.

Using a PC to remove partitions

For most users using a PC is probably the easiest way to proceed. This involves:

  • Remove the drive from the TeraStation and attaching it to a PC either internally or via an external disk enclosure. For the IDE based models (Original and Home Server) there are instructions on how to open the case to get at the drives at the back of the manual. For the Pro v1 using SATA drives it is much easier as the door at the front can be opened and the drives simply released and slid out.
  • Run the Windows Disk Manager software to remove all the partitions on the drive.
  • Replace the drive in the TeraStation.
  • Switch on the TeraStation.

Using the TeraStation to remove partitions

This option is only possible if you already have telnet enabled firmware installed on your TeraStation.If you have got telnet enabled firmware installed on your TeraStation:

  • telnet to the TeraStation, and log in with a user with root privileges (e.g. myroot)
  • Run the disk partitioning software using a command of the form mfdisk //dev/device where device is hda/hdc/hde/hdg for the four drives in IDE based models or sda/sdb/sdc/sdd for those in the Pro model. Make sure you get the right device name as otherwise you will lose all your data.
  • Delete all partitions on the disk
  • Save the results back to the partition table. This will exit the mfdisk program with an error message about being unable to resync procee the disks.
  • Use the"reboot" command to stop/restart the system

Recovering the Array

  • The system should now come up without issues, but when you go into the Web GUI it will tell you that the RAID array has been damaged.
  • Select the RAID array and you will be taken to the screen where the array is repaired. You should be able to select the drive that failed (all the others should be greyed out) and given an option to repair the array.
  • If you select this option then (depending on the firmware release) you will be given a screen in Japanese asking you to enter a displayed number as a confirmation. Enter the number and then select the left-most button to proceed.
  • The system will put up a screen about recovering the array. At this point the new drive will be partitioned and formatted, and added to the RAID array. While this is going on (which normally takes a few minutes) all file access to the TeraStation is suspended.
  • Once the array has been "fixed" the File Serving services will be resumed, and the the process of Resyncing the array will start. During this stage file accesss is allowed, but performance is degraded. This stage can take a long time with the length of time depending on the size of the array - as an example a 1Tb array takes about 5.5 hours, and other sizes will be pro-rata.

When replacing the drive is is recommended if at all possible that you replace the drive with another of the same make and model. Some people have success with using a different make/model that is of the same size (or larger) so it isn up to you whether you try this.

When you are going to replace the drive, then the replacement should be unformatted wtih nopartitions on it. If it is an IDE model (the Orignal and Home Server models), then make sure that the jumpers are set it make it the Master/Only drive. Many drives come with the jumpers set to Slave on the assumption that they are being added as an additional drive to an existing PC. If the jumpers are incorrectly set to the Slave position then the drive will not be recognised by the TeraStation.

Replacing All the Hard Disks

The most likely reason for replacing all disks is that you are intending to upgrade the capacity of your TeraStation.

If the new disks are of size 500Gb or less then proceed as follows:

  • Replace all existing drives with 4 identical drives. If they are IDE drives ensure that the jumpers are set for them to be Master/Only drives. Also make sure that there are no existing partitions on the drives.
  • Switch the TeraStation on and it will come up in EM-Mode ready to accept a reflash.
  • You will probably need to reflash the system twice - once to partition/format the drives, and the second time to copy the system software to the new hard disks. If during the flashing process you get a timeout message, then quit the Flashing process. Leave the TeraStation alone until all the disk activity lights have stopped, and then start the second flash. When flashing it is a good idea to use the Debug Mode of the firmware updater, and set the option to "clear user-config".
  • At the end of this process the system will be operating as if it was a brand new TeraStation at the new disk capacity.

If you want to use disks that are larger than 500Gb then see this article on TeraStation and Larger Hard Disks.

Telnet Enabled Firmware

TeraStations internally run the Linux operating system. Buffalo hides this from the average user by providing the system "packaged" with a browser based GUI to control and configure it. Telnet enabled firmware allows users to log in using a telnet client to control and manipulate the system at the Linux command line level.

This allows users to do things like:

  • Configure the system at a more detailed level than allowed for by the Buffalo GUI.
  • Upgrade components of the underlying software to newer versions with additional features and/or bug fixes included.
  • Install new applications to extend the functionality of the Terastation.
  • In the event of any problems being encountered, allow for a level of access that gives more chance of recovering user data without loss.

The changes described in this article require the use of a telnet enabled release. Hopefully the instructions provided are detailed enough that users can carry out the steps provided without needing much Linux knowledge.

The standard software supplied with buffalo PPC based TeraStations does not provide for telnet access. Telnet enabled releases of firmware corresponding to virtually all Buffalo firmware releases can be found at itimpi's website. These are identical in functionality to the corresponding Buffalo firmware releases - the modification to add telent functionality being trivial. This means they will have exactly the same bugs (if any) as are found in the Buffalo releases.

The itimpi firmware releases are the ones that have been used while preparing this article. Firmware from other sources should work fine as long as it is telnet enabled.

To use telnet you need a telnet client. A rudimentary one is included with Windows which you can invoke by typing a command of the following form into the Windows Run box:

telnet TeraStation_address

A freeware one called PuTTY is recommended as a much better alternative. In addition to the standard telnet protocol PuTTY also supports the more secure SSH variant (although additional components need installing at the TeraStation end to support this).

EM Mode

In the forums there is a lot of discission about EM mode (also known as Engineer or Emergency Mode). If the TeraStation is in this mode, and its network connection is working, then you will find that it will have "EM" as part of the node name.

The reason why EM mode is considered important is that in this mode the TeraStation has successfully booted the Linux Kernel from Flash, and is running from a RAM disk (also loaded from Flash). In EM mode the additional services such as File Sharing are not available, but the Linux system running at that point is sufficient to allow for updating the flash, and writing System files to disk.

The TeraStation will go into EM mode anytime it detects that the System Partition on the Hard disks does not appear to contain a working Linux system. In some circumstances, however, the Hard Disk appears to contain a working Linux system, but some of the files on the System partition have been damaged in some way. In such cases special actions need to be taken to force EM mode.

Using the Firmware Updater

Just to be safe, it is a good idea to back up your data before attempting this upgrade. If things go well your data will survive fine, but if anything goes wrong there is a small chance that your data will no longer be accessible.

The computer running this firmware update program must be connected to the TeraStation’s network by a wired connection. A wireless connection will not do! Disable any firewall software on the PC before running the firmware update. Unzip the firmware in the file you downloaded into a folder on your PC.

To apply this update you need to run the firmware updater program that is the folder you created when unzipping the downloaded firmware. The name of this program can vary according to what version of firmware you downloaded, but should be the only executable program in the folder. The firmware updater program runs fine on Windows 2000 and Windows XP SP2. For XP SP1 and other versions of Windows, set the program to run in Windows 2000 compatibility mode Do this by right-clicking on the updater (e.g. HD-HTGL FWUpdate.exe) icon, selecting Properties, and choosing the compatibility tab.Put a check next to Run this program in compatibility mode for: and select Windows 2000 from the drop-box if it’s not already there.

Execute the application file (e.g. HD-HTGL FWUpdate.exe).

Normal Mode

This will come up with a dialog like the following:

TS update main.jpg

and report some basic information about the TeraStation including its current firmware version. <p> If you have multiple teraStations, then select the appropriate one from the drop-down list. Note that only TeraStation models for which this update is valid will be listed). Click on the Update button (sometimes labelled as Renew Firmware). On Japanese versions of the Updater program this is the leftmost button on the main screen. On the next window it will ask for an Admin password. By default the username is:Admin and the password is: password. Of course, if you’ve changed the Admin password on the TeraStation, use your new one! The firmware update will take 3 to 5 minutes to complete and while it is running a number of dialogs will be displayed informaing you of progress. If you never get the OK button, or you get a failure or error message, you may want to try the steps below:

  • On the computer that you are doing the firmware update from, make sure that any software firewalls (such as Windows Firewall,ZoneAlarm, Black Ice, etc.) are disabled.
  • Make sure that your computer is connected to the network with a wired Ethernet connection, not a wireless one.
  • If the firmware update still fails, try a different setup:
  1. Connect the TeraStation directly to your computer, with either a regular Ethernet or crossover cable, directly from the TeraStation’s RJ-45 Ethernet port to the RJ-45 port on your computer’s network interface card.
  2. Change the IP address of your computer to with a subnet mask of
  3. Reset the TeraStation by holding down the Init button for 30 seconds. Power down the TeraStation, then turn it back on.
  4. Ping to make sure that your PC is able to communicate with the TeraStation.
The steps involved in this are:
  • Click on Start, then select Run.
  • In the run window enter "cmd" and press OK. This will give you a Command Prompt window.
  1. Type ping and press the enter key.<p>If your connection is good, you’ll see the words “Reply from” in response to the 4 attempted pings.<p> If the connection is bad, you’ll likely see “request timed out” instead.
    If that happens, something is wrong with your Ethernet connection.
    Check your Ethernet cable, reset the TeraStation again, and make sure that there are no firewall programs running on the computer (and that includes the Windows XP firewall!).
    Restart the TeraStation and try pinging again until you get a successful ping.
    Then go to step 5.
  2. Rerun the firmware update.
  3. Once the update has completed, reconnect your TeraStation and PC to your network.
  4. Change your IP address back to “obtain an IP address automatically”. Windows XP users will need to also make sure that DNS is set back to “obtain DNS server address automatically”.
  5. Run the IP Setup Utility again and setup your IP address to work with your network
  6. You may want to log back into the TeraStation to make sure that the unit is setup the way you want it. After doing the reset, all files and folders will remain but any user or folder
restrictions will have to be setup again. Also, any mapping will have to be redone even if you set the unit back to the same IP address.

Debug Mode

If you are having problems you might want to run the Flash Updater in Debug Mode

To do this the first thing you need to do is to check the .INI file (normally called NASUPDATER.INI) that is the same folder as the executable program. You can load it into any text editor such as Notepad. Check that it includes the following lines:

 Debug = 1

If their is already a [SpecialFlags] section in this file, then merely add the Debug line.

Once you have done this, when you start the program for flashing it will present its initial screen along the lines indicated earlier.

If you now click on the yellow rings at the top left of the screen you are able to select the Debug option which comes up with the following dialog:

TS update debug.jpg

which allows you to control elements of the flashing process.

The default options fora standard flash will be pre-selected. Options you might want to consider altering are:

  • BOOT: This indicates that the Boot area of the Flash should be renewed
  • KERNEL: This indicates that the copy of the Linux kernel in Flash should be updated.
  • HDD: This indicates that the main Linux system held on the Hard Disk should be updated.
  • Do Not Check Version: Do not carry out any firmware version checks. Normally you are only allowed to update to a higher version than that already installed. Setting this option allows one to downgrade versions.
  • Rebuild Partition Table: This Clears down all partitions on the disk, and then rebuilds the standard Partition table and formats these partitions.
  • Delete user-Config: This clears down the user config information that is stored in flash while the flashing is in progress, and then restored to the hard disk on completion. Setting this option will return all settings to factory defaults.

When you have the settings as you want them to be, press the OK button to return to the main screen ready to start flashing.

Flash Error

A Flash Error is indicated by:

  • TeraStation Pro: Error E04 on LCD Panel
  • TeraStation Original or Home Some Sever: 5 blinks every four seconds of red Diag light

The full list of Diag LED codes can be found [url=http://buffalo.nas-central.org/index.php/Hardware_LEDs here].

Flash errors are actually very rare unless they occur just after you have done a firmware upgrade and it turns out that you have a defective flash chip so that the update failed.

In practice it has been found that a good rule-of-thumb is that if the above error occurs very rapidly (i.e. within about 5 seconds) after power on then it probably really is a Flash error. If it takes much longer (greater than 30 seconds) and the system appears to start its normal booting sequence before this error is given then it is actually much more likely that the system files on the hard disk have become corrupted.

To recover from a genuine flash error requires use of the JTAG method of rewriting the flash. This is covered in a number of wiki articles if you want to attempt to do this yourself. There are also a number of forum members who are prepared to attempt JTAG recoveries on behalf of members. If you are interested in availing yourself of such a facility you should post a forum message giving your location so that members who are geographically closest to you can be identified.

To recover from the situation where the system will not boot look at the section below.

Boot Does not complete

If the boot process seems to run for some time (> 30 seconds) before failing then this means that there is something wrong with the system files on the hard disk. There are various variants of this type of error:

  • System fails with an E04 error (TS Pro) or with the red DIAG light flashing 5 times (Original and Home Server)
  • System fails with an ??? error (TS Pro) or with the red DIAG light flashing 6 times (Original and Home server)
  • System appears to boot OK - but network never becomes active. See the steps to recover from this condition given in the next section.
  • The system appears to boot fine, and the LINK/ACT light becomes active but services such as file sharing are not started.

he first two cases are by far the most frequent. They seem to be particularily likely to happen if the TeraStation is powered off unexpectedly (like a Power Cut). In these cases the normal method of recovering is to:

  • Clear Down the System partition (see below for instructions on how to do this)
  • Boot the system - it should come up in EM mode.
  • Reflash the System to cause the system files on the hard disk to be rewitten. If you want to run the Firmware Updater program in Debug mode you can elect to rewrite the hard disk without updating the flash areas. If not run in debug mode these will be refreshed as well. If this works one normally finds that your data magically re-appears although if the data is important it is still recommended you try and back it up first.

Every so often after the above steps the system will still not start. In these cases it may be necessary to clear down all the User Config information saved in the flash. To do this one has to run the Firmware Updater program in Debug mode. Note that if you do this it may trigger a reformat of teh data area on your hard disks so make sure you have backed up your data before attempting this step.

Network Will not Start

This is the situation where the system appears to boot OK, but at the end of the Boot sequence the LINK/ACT light never becomes active to show that the network has been restored. One cause of this can be that the /etc/networks/interfaces file stored in the Configuration Save area has become corrupt. As the system always over-writes the disk copy from the flash copy on disk as part of the boot sequence some special actions need to be taken to recover from this scenario.

To understand this issue, one needs to understand how the TeraStation Loads/Saves key configuration information.

  • Every time the TeraStation shuts down, it takes its internal configuration files, compresses them and writes the compressed archive to an area of its flash.
  • When the TeraStation is booting, it reads the flash, uncompresses the config files and overwrites specific configuration files which reside in the system partition of the hard disk - one of these being the /etc/networking/interfaces file.

The problem is that if the copy of this file held in the flash Configuration Save area ever gets corrupted (sometimes set to 0 length), then as there is no check of the config files on booting the TeraStation can overwrite the disk based version of the file with the bad version from the Config Save area. In the case of the /etc/networking/interfaces file this is fatal, because the /sbin/ifup command run during the boot process fails to power up the ethernet interface with the result that the TeraStation is not reachable via the network.

The error remains also in a forced EM-mode (removing all disks), as config data is treated the same way in EM mode.

You cannot recover from this error by flashing, as the TeraStation will not be able to communicate over the ethernet interface, and thus the flashing process cannot be performed.

The most reliable way to recover from this type of error is to use the JTAG method of clearing down the user config area in the flash. However most users will not want to go the lengths of using JTAG as it requires adding a JTAG header to the TeraStation motherboard, obtaining a JTAG cable, and then running JTAG software to rewrite the flash.

Another solution if you have root access (as provided by the telnet enabled variants of firmware) is to add a serial port to the TeraStation. You can then log in via the serial port and make alterations discussed below from that session.

Another way to recover your TeraStation from this error relies on you having a valid system partition on at least one disk. If you had a previously working system you almost certainly already have this in place. If not you would need to obtain a disk image of a working system or the files that belong on this partition. How to get these files is described at the end of this article.

The recovery process is as follows:

If you have serial console access and a username/password that you can use for root level access (this would probably mean you had previously installed a telnet enabled firmware release) then you can fix this by doing the following:

  • Login as a user with root privileges (typically the 'myroot' user on the itimpi firmware releases).
  • Check that you are running off the hard disk by using the 'mount' command. It should display a line that looks like:
 /dev/md0 on / type auto (rw,noatime)

which shows that the hard disk is mounted as the root partition.

  • Create a /etc/networking/interfaces2 file and configure it corresponding to your needs. A sample file is shown below.
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static

This file is set to use a static IP address of You can use a different one if it is more convenient.

  • Create an executable file /etc/init.d/network_workaround containing the following line to copy the good file over the bad file:
cp /etc/networking/interfaces2 /etc/networking/interfaces
  • Create a symlink /etc/rc.d/rcS.d/S39network_workaround -> ../init.d/network_workaround to run the above command at the correct time during the boot sequence. This is done by using the following commands:
cd /etc/rc.d/rcS.d
ln -s ../init.d/network_workaround S39network_workaround
cd /etc/rc.d/rc3.d
ln -s ../init.d/network_workaround S39network_workaround

If you do not have serial access, then you can achieve the same results by:

  • Attach the disk to a PC running Linux.
  • Partition 1 (the system partition) will probably automount. Use a df command to see the device name used - it will vary according to your PC configuration.
  • Carry out the changes mentioned above.
  • Zero partition 1 on disks 2, 3 and 4. This is to force it to use the copy from disk 1. This can be done using commands of the form:
 dd if=/dev/null of=/dev/xxx1

where xxx was the device name mentioned above

The purpose of the above modifications is to copy a good version of the /etc/network/interfaces file over the one restored from the flash area at the right point in the boot process so that the ethernet interface is started correctly. After this modification your TS should be reachable again. You can then try to fix it via the web interface or flash it with a modified firmware and fix it manually.

Clearing Down the System Partition

There are times when clearing down the system partition will force the system to boot from Flash, and then come up in a mode where you can force the files on the System partition to be rewritten.

Making a Backup of the Partition

It is strongly recommended that if at all possible you make a backup of the system partition before clearing it. This means if that for any reason you have misdiagnosed the problem with your TeraStation and you want to restore it you can do so.

To do this:

  • Remove Disk 1 from the TeraStation and attach it to another system. This can be done either internally or via an external Disk Enclosure attached via USB or Firewire.
  • Boot the system into Linux. If your system does not run Linux normally, then you can use one of the "Live" distributions that run from CD/DVD rather than the hard disk. This would avoid you having to actually install Linux onto this system.
  • Make sure that you know how to run commands with 'root' privileges. Depending on the variant of Linux chosen this may mean either logging in as 'root' or running commands via the 'sudoer' facility.
  • The system will probably have automounted the TeraStation hard disk. If so you check what it has been mounted as using the mount command.
    Now unmount it using a command of the form:
umount /dev/devicename
where the devicename value will be the one you noticed was used for the TeraStation disk in the output of the mount command.
  • Make a copy of the TeraStation system partition using a command of the form:
dd if=/dev/devicename of=/filename

where devicename is as described above, and filename is the output file. This file will be a little under 400Mb in size. Make sure that it is secured somewhere that will not be lost when you reboot the Linux system (such as USB stick or external USB drive).

Clearing Down the System Partition

Now that you have a backup in case things go wrong, you can use the following steps to clear down the system partition.

  • Connect each disk in turn to a PC running Linux
  • When the disk is mounted, go to the root of the disk and issue the command:
rm -fr *
to remove all files from the disk. Do not try to repartition the disk or reformat the partition as this will almost certainly later cause a reformat of the data area to happen as well.
  • Unmount the disk on the Linux system to ensure changes are written out to the disk.
  • Put the disks back into the TeraStation.
  • Reboot the TeraStation and it should come up in EM mode ready to be reflashed using the Firmware Updater.

Obtaining Files for System Partition

For some of the methods of TeraStation recovery it can be useful to have copies of the files that the firmware updater would write to the system partition.

This is easy if you have access to PPC based Linux system. Proceed as follows:

  • Download the file tera_newfiles.tgz.
  • Unpack this archive into the same location as the files holding the firmware release for which you want the files that belong on the system partition.
  • Change to the newfiles folder
  • This file contains all that is used by itimpi to generate his telnet enabled variants of the Buffalo firmware releases. Of particular interest if you want a copy of the files that belong on partition 1 is the script unpackfw.sh. Running this will extract all the files that belong on the root partition to a folder fw. The passwords for each firmware release are in the file Password.txt.

This script should also work on Linux systems that are not PPC based, but then you would have to make sure you have zip/unzip binaries that are compatible with the variant of Linux you are using as the ones included in the download mentioned above are PPC specific.

Recovering files from NAS with Windows PC

Buffalo TeraStation and Linkstation products use the XFS file system for their data storage. This file system has support of commercial data recovery software for recovery of deleted files. The known software that supports recovery of deleted files from XFS are:

Both products require optional extension: RAID Access Plugin - RAID Builder.

The other product you may require are:

Other requirements:

  • Computer with Microsoft Windows (Windows 2000/XP/Vista/7 or their "Server" editions);
  • 4 free SATA ports:
    • on computer motherboard;
    • on PCI/PCI Express expansion card;
    • on USB-to-SATA adaptor(s).
  • Additional NTFS-formatted hard drive to store recovered information or enough free disk space on system drive.

To recover information from a NAS with your PC you have to re-connect NAS drives to the computer:

  • Turn off your NAS and eject all four drives from NAS. Mark their original positions (1,2,3,4) with paper stickers or soft ink marker.
  • Connect all drives to your Windows PC with motherboard connectors OR PCI/PCI Express expansion or USB-to-SATA adapter(s). It's strongly recommended to keep valid drives order.

Motherboard connectors: try to connect first drive (#1) to first free SATA connector (e.g. SATA2), second (#2) - to second (SATA3) and so on.
PCI/PCI Express expansion card: connect first drive (#1) to port #1, second drive (#2) to port #2 and so on.
USB-to-SATA adapters: connect first drive (#1) first, then second (#2) and so on.

  • Boot your system. If required, wait for hard disk drivers installation and reboot the system.
  • Run free trial copy of UFS Explorer Professional Recovery. It should display list of all detected drives at left panel. The list of drives must include:
    - Your existing (system) drive(s);
    - 4 drives from you NAS.

Each NAS drive will have same partitions structure: boot partition (Ext2/3 or XFS), swap partition, Data partition (the largest partition, about 99% of total disk size) and optional 'padding partition'.
In case you can not see all four drives in UFS Explorer, shut down your system and check hardware connection

Deleted files recovery

To recover deleted files from Buffalo NAS with default configuration (RAID5 on 4 drives) follow these steps:

  • Connect drives from NAS to your Windows PC;
  • Run UFS Explorer Professional Recovery;
  • Verify system detected drives order. First NAS drive (e.g. "HDD1:..." in UFS Explorer) should contain detected XFS file system on data partition. The other drives should have 'Unknown file system' on their data partitions.

To verify drives order you may use UFS Explorer Professional Recovery or HxD.

- Right-click data partition of any NAS drive in UFS Explorer and choose 'Show/Edit properties';
- copy hex value of 'Disk range start (sector)' and multiply it by 0x200 (hex);
- open drives in HxD and then goto (Ctl+G) specified disk position.
UFS Explorer:
- Right-click data partition of each disk and choose 'HEX preview...' option.

Data partition of first drive should start with file system superblock. The key element is "XFSB" identification string. The data looks like this:

0000: 58 46 53 42 00 00 10 00 │ 00 00 00 00 2B 9C CD 10  XFSB  ►     +Ь═►
0010: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00
0020: F6 70 97 75 22 84 48 2C │ 8D 11 16 5D 0E 92 77 F4  ЎpЧu"ДH,Н◄■]♫ТwЇ
0030: 00 00 00 00 15 D0 00 10 │ 00 00 00 00 00 00 01 00      §╨ ►      ☺
0040: 00 00 00 00 00 00 01 01 │ 00 00 00 00 00 00 01 02        ☺☺      ☺☻
0050: 00 00 00 30 00 10 00 00 │ 00 00 02 BA 00 00 00 00     0 ►    ☻║
0060: 00 00 80 00 3D 84 10 00 │ 01 00 00 10 00 00 00 00    А =Д► ☺  ►
0070: 00 00 00 00 00 00 00 00 │ 0C 0C 08 04 14 00 00 19          ♀♀◘♦¶  ↓
0080: 00 00 00 00 00 1B 39 40 │ 00 00 00 00 00 0B 67 3E       ←9@     ♂g>
0090: 00 00 00 00 29 46 B1 6A │ 00 00 00 00 00 00 00 00      )F▒j
00A0: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00

Data partition of second drive should start root directory inode. The key elements there are "49 4E 41" bytes at start and names of root folders (e.g. "share") inside. The data looks like this:

0000: 49 4E 41 FF 01 01 00 07 │ 00 00 00 00 00 00 00 00  INA ☺☺ •
0010: 00 00 00 07 00 00 00 00 │ 00 00 00 00 00 00 16 81     •          ■Б
0020: 47 9D 6B 54 01 34 55 98 │ 48 3E 3E 6C 2A D8 D3 88  GЭkT☺4UШH>>l*╪╙И
0030: 48 3E 3E 6C 2A D8 D3 88 │ 00 00 00 00 00 00 00 5D  H>>l*╪╙И       ]
0040: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00
0050: 00 00 00 02 00 00 00 00 │ 00 00 00 00 00 00 00 00     ☻
0060: FF FF FF FF 06 00 00 00 │ 01 00 05 00 30 73 68 61      ♠   ☺ ♣ 0sha
0070: 72 65 00 00 01 03 0B 00 │ 40 2E 61 63 63 65 73 73  re  ☺♥♂ @.access
0080: 74 65 73 74 00 00 01 04 │ 0C 00 58 46 42 53 5F 41  test  ☺♦♀ XFBS_A
0090: 72 63 68 69 76 65 73 96 │ 00 3E 01 04 00 70 4B 49  rchivesЦ >☺♦ pKI
00A0: 54 53 1F 00 22 3C 05 00 │ 80 45 6C 69 73 61 9E 00  TS▼ "<♣ АElisaЮ
00B0: 06 15 08 00 90 44 69 73 │ 70 61 74 63 68 0E 00 19  ♠§◘ РDispatch♫ ↓
00C0: 30 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00  0

Data partition of third drive may contain data or may continue inodes table. Usually it looks like:

0000: 49 4E 81 F6 01 02 00 01 │ 00 00 00 63 00 00 00 63  INБЎ☺☻ ☺   c   c
0010: 00 00 00 01 00 00 00 00 │ 00 00 00 00 00 00 00 01     ☺           ☺
0020: 3E 30 3A 7B 00 00 00 00 │ 3E 30 3A 7B 00 00 00 00  >0:{    >0:{
0030: 47 C7 99 C4 34 D5 60 18 │ 00 00 00 00 00 01 59 DA  G╟Щ─4╒`↑     ☺Y┌
0040: 00 00 00 00 00 00 00 16 │ 00 00 00 00 00 00 00 01         ■       ☺
0050: 00 00 00 02 00 00 00 00 │ 00 00 00 00 00 00 00 00     ☻
0060: FF FF FF FF 00 00 00 00 │ 00 00 00 00 00 03 7A 03               ♥z♥
0070: 1E 00 00 16 11 0C 21 1E │ F4 46 42 19 D9 92 23 A2  ▲  ■◄♀!▲ЇFB↓┘Т#в
0080: 3E 47 44 74 47 08 47 88 │ E4 47 44 70 50 47 03 C3  >GDtG◘GИфGDpPG♥├
0090: 5F C4 44 44 45 94 E1 88 │ 88 88 F5 84 14 2A 11 11  _─DDEФсИИИїД¶*◄◄
00A0: 11 11 11 20 78 69 8F 7E │ E8 8C 46 22 F1 78 F6 47  ◄◄◄ xiП~шМF"ёxЎG
00B0: 44 42 23 E4 70 2F FA 08 │ 11 4E A5 74 F8 75 CD 03  DB#фp/·◘◄Nеt°u═♥
00C0: 34 21 11 11 C4 5F E7 63 │ C1 04 90 4A FF CE 39 43  4!◄◄─_чc┴♦РJ ╬9C

The data partition of last drive must contain RAID5 parity and contain XOR "mix" for data from 1st-3rd drives. It may look like:

0000: 58 46 93 4B 00 03 10 06 │ 00 00 00 63 2B 9C CD 73  XFУK ♥►♠   c+Ь═s
0010: 00 00 00 06 00 00 00 00 │ 00 00 00 00 00 00 16 80     ♠          ■А
0020: 8F DD C6 5A 23 B0 1D B4 │ FB 1F 12 4A 24 4A A4 7C  П▌╞Z#░↔┤√▼↕J$Jд|
0030: 0F F9 A7 A8 0B DD B3 80 │ 00 00 00 00 00 01 58 87  ☼∙зи♂▌│А     ☺XЗ
0040: 00 00 00 00 00 00 01 17 │ 00 00 00 00 00 00 01 03        ☺↨      ☺♥
0050: 00 00 00 30 00 10 00 00 │ 00 00 02 BA 00 00 00 00     0 ►    ☻║
0060: 00 00 80 00 3B 84 10 00 │ 00 00 05 10 30 70 12 62    А ;Д►   ♣►0p↕b
0070: 6C 65 00 16 10 0F 2A 1E │ B8 64 2B 7E AE F7 50 C8  le ■►☼*▲╕d+~оўP╚
0080: 4A 22 37 00 47 13 7F CC │ E8 47 1C 36 12 1F 3B BC  J"7 G‼⌂╠шG∟6↕▼;╝
0090: 2D A7 2C 2D 1A B7 23 74 │ 88 B6 F4 80 14 5A 5A 58  -з,-→╖#tИ╢ЇА¶ZZX
00A0: 45 42 0E 20 5A 55 8A 7E │ 68 C9 2A 4B 82 19 68 47  EB♫ ZUК~h╔*KВ↓hG
00B0: 42 57 2B E4 E0 6B 93 79 │ 61 2F D1 07 90 7B CD 2A  BW+фрkУya/╤•Р{═*
00C0: 04 2D 01 11 C4 5F F7 63 │ C1 04 90 4A FF CE 39 43  ♦-☺◄─_ўc┴♦РJ ╬9C

  • Basing on this information, write down the order of drives detected by system. E.g. #1 = "HDD1: Fixed...", #2 = "HDD2: Fixed..." etc. In case you connected drives in reverse order, this could be #1 = "HDD4: ..", #2 = "HDD3: ..." and so on.
  • Test RAID configuration:
- Click 'Build RAID' button in UFS Explorer Professional Recovery. 
- Choose 'RAID array on disk partition...' from drop-down and press 'Next';
- For each data partitions, choose it at left list and press 'Add >>'. The drives order must be the same as identified above;
- Press 'Build' to open 'SoftRAID' in UFS Explorer.

If build is correct, virtual 'SoftRAID' will appear and it will contain single XFS file system partition. You should be able to browse it and see your current files.

  • Build the RAID in UFS Explorer Standard Recovery version 4 or Raise Data Recovery for XFS:
- Make sure you installed RAID Access Plugin - RAID Builder for it;
- Run the software;
- Press 'Open...'  and then 'Build RAID' in drop-down menu;
- Build the RAID like you did with UFS Explorer Professional Recovery;
- Confirm RAID configuration and new RAID virtual drive drive will appear in UFS Explorer upper list.
  • Test the RAID configuration in UFS Explorer Standard Recovery:
- Select RAID virtual drive in upper list (opened drives). Single XFS data partition should appear at bottom list;
- Double-click this XFS partition to open in UFS Explorer;
- Browse file system to make sure you can see all existing (not deleted) files.
  • Recover deleted files:
- Choose 'Recover lost data' option from "Partition" context menu or form main menu;
- On the next form change nothing, just press 'Next';
- On the next form make sure only 'find lost and deleted files option' is checked. Press 'Ok'.
- The software will run recovery and this take awhile;
- After scan will complete - new 'Deleted files' virtual folder will appear.
  • Backup the scan result (the option is available in 'Deleted files' virtual folder context menu.
  • Copy required files to safe location (any external or system drive), excluding original NAS drives.

After recovery will be completed, shut down your PC, disconnect NAS drives and put them back into NAS. Start the NAS and your PC. Copy recovered files back to NAS via network.

Data recovery after storage format (re-initialization)

Some operations, such as NAS auto-recovery may lead to storage file system format (NAS runs 'mkfs' as part of process). This writes new empty XFS file system with default folders (like 'share') to the storage partition of the NAS and makes all existing data inaccessible.

'mkfs' results include:
- New file system superblock;
- New root folder;
- New (empty) information about free space;
- New set of backup superblocks;
- Several megabytes of data on storage may be destroyed permanently.

The data from NAS still could be recoverable and to recover the information you should follow these steps:

  • Connect drives from NAS to your Windows PC;
  • Run UFS Explorer Professional Recovery;
  • Verify system detected drives order. First NAS drive (e.g. "HDD1:..." in UFS Explorer) should contain detected XFS file system on data partition. The other drives should have 'Unknown file system' on their data partitions.
  • Test RAID configuration:
- Click 'Build RAID' button in UFS Explorer Professional Recovery. 
- Choose 'RAID array on disk partition...' from drop-down and press 'Next';
- For each data partitions, choose it at left list and press 'Add >>'. The drives order must be the same as identified above;
- Press 'Build' to open 'SoftRAID' in UFS Explorer.

If build is correct, virtual 'SoftRAID' will appear and it will contain single XFS file system partition. You should be able to browse it and see default folders which appeared after NAS re-initialization.

  • Run data recovery:
- Right-click XFS partition on NAS and choose 'Data Recovery: advanced scan';
- Choose 'File system reconstruction' option from 'Recovery pre-set' dropdown. Other options should remain default;
- Press 'Ok' to start the scan.
  • To test RAID build and recovery quality, stop the scan after about 1% is completed.
- The scan will abort and XFS file system under SoftRAID will turn to 'Reconstructed file system';
- Browse the 'Reconstructed file system'. It should contain set of folders with names like "inodeXXXX" or real names and files inside;
- Test the files;
- In case files are bad - check RAID configuration once again;
- In case files are good - right-click 'Reconstructed file system' and choose 'Destroy Data Recovery result...'.
  This will turn 'Reconstructed file system' back to XFS and you then may restart the full scan.
  • After scan will complete, XFS file system under SoftRAID will turn to 'Reconstructed file system'. Protect the scan result: right-click it and choose 'Data Recovery: save advanced scan result'.
  • You may now copy files to safe location (any 'local', 'network' or removable drive).
Note: some folders and files still may have names like "inodeXXXX" and have wrong position. The reason is data loss caused by mkfs.