Recently, we had received another case on Buffalo NAS 4TB Raid 1. According to customer description, this NAS got a Ransomware virus attack before, and now the customer sends in for us to check whether everything inside the folder is fine. And possible back up the data.

When our data recovery specialist first receive this NAS from the customer. He performs an entire scan of the NAS enclosure by double check the entire cover. After finding out everything was fine. The next step, our data specialist need to find out the IP address of the NAS, he first connects the NAS to switch using the network cable and open the router interface to see whether the device can detect the NAS, but fail to detect the IP address. The reason probably due to the different subnet, in order to find the IP address, our data recovery specialist connect the NAS to the computer, and the utility controller of the NAS prompt out automatically, our data recovery specialist discovered the IP address of the NAS is 192.168.1.X, which is not fall within the same IP address range, that is the reason why we cannot detect the IP address of the NAS.

Now we just configure the network property to make both IP addresses fall on same IP address range. And now the folder can be readable. Next, our data recovery specialist uses the IP address to access the NAS, to check the states of the NAS, after looking all the report, our specialist did not find any issue of the NAS. But this doesn’t mean the NAS is in good condition. We still need to check the hard disk, as the result shows this RAID 1 NAS which means customer store the same data into 4 disks, and the 4 disk is separate into 2 pairs. If one pair of hard disk fails, we can still retrieve data from another pair.

And now the problem we see all the data is stored in the pair 1, pair 2 contains nothing. So we need to find out the reason by open out the enclosure. But we need to back up the data first in case if we did something wrong, we can recover the data back.

After back up finished, our data recovery specialist using our data recovery tools to analysis one of the hard disk from pair 2, try to find out any hidden, or any spoiled files cause by the ransomware.

Fortunately, everything inside the folder is fine. So we just help the customer move his data to a new hard disk.

Lastly, our customer was satisfied with our service.