A Manchester business rang the morning after an employee left. The shared folders were empty and the array was in perfect health — six disks, no degradation, no errors. The hardware was the one thing that had behaved.
← All case files · from £500 + VAT
Shared folders on the Synology were empty — client records, project files, contracts, invoices and internal reporting. The unit’s own logs recorded the deletions and which account was signed in when they happened.
The array itself was untouched. Six disks, all present, RAID 10, no degradation, no errors. That is an unusual position: normally the work is done around failed hardware, and here the hardware was the only thing that had not caused a problem.
The array’s job is to present a reliable block device. Files and folders live in the file system sitting on top of it. A deletion is a file-system event — it changes blocks, and the array faithfully writes that change to every disk it should.
This is where the common understanding goes wrong. A mirror protects against a disk failing, not against someone removing data. Both halves show the deletion, simultaneously, because faithfully reproducing writes is the entire point of a mirror.
Synology’s default file system is copy-on-write. It does not modify metadata in place: a changed tree block is written to a new location and the root updated to point at it. Superseded structures frequently survive long after the pointers to them are gone.
Deleted content survives only until something is written over it. The business stopped using the NAS the moment they noticed, which is why nearly all of it came back.
Worth being blunt, because it shapes what people expect. If a colleague deletes your files, no RAID level saves you — not 1, not 5, not 6, not 10. Snapshots and off-device backups protect against deletion. Redundancy protects against hardware. They are different problems and buying more of one does nothing for the other.
The technical substance of this job is Btrfs behaviour, so it is worth setting out.
A traditional file system updates metadata in place: delete a file and the directory record and allocation structures are rewritten where they sit, destroying the previous version. Btrfs never does this. Every modification writes new blocks elsewhere and updates a chain of pointers up to a new tree root, each root carrying a generation number. The previous root, and everything it referenced, remains physically on disk until that space is reallocated.
So a deletion in Btrfs does not overwrite the directory structure describing what was deleted. It writes a new structure without it, and leaves the old one intact and findable — older roots located by their signature and generation number, then walked to recover the directory tree exactly as it stood before the deletion.
The extent tree matters just as much. Btrfs tracks allocated regions separately from the files referencing them, so extents that have been unlinked but not yet reallocated can be identified as orphaned, matched against the recovered directory records, and reunited with their filenames.
That last point decides whether a recovery is useful. Carving by signature gives you thousands of unnamed files in a folder called recovered. Rebuilding from superseded metadata gives you the original tree, with names, paths and timestamps — which is the difference between a usable result and an archive nobody can search when the material is contracts and client records that have to be found by name.
Where a deletion looks deliberate, the data is not the only thing at stake. The unit’s logs, its access records and the file system’s own timestamps together establish what was removed and when — and a recovery that writes to the volume can disturb exactly that.
So the position was preserved first. Every disk was imaged read-only with a cryptographic hash recorded for each image at the point of capture, so any later question about whether the evidence had changed can be answered arithmetically rather than by assertion. All work then ran against the copies, and the original disks were sealed and set aside untouched.
Btrfs helped here too. Because superseded metadata survives with its generation numbers intact, the recovered structures carry their own chronology — it is possible to establish not only what was deleted but the sequence in which it went.
That cost nothing and delayed nothing, and it meant the client kept the option of a tribunal or a police report without having to decide on day one. Most clients in this position want only their data back. A few, weeks later, want an account of what happened. Imaging first keeps both open.
All six disks were imaged, then the RAID 10 reassembled virtually from those images with the geometry derived from the data rather than trusted from the enclosure — mirrored pairs identified by comparing images directly, and the stripe order established by testing candidates against whether the file system resolved coherently.
That produced the logical volume as it stood after the deletion. The Btrfs structures were then examined for superseded roots, older metadata trees and orphaned extents, and the pre-deletion directory tree rebuilt from them.
Recovered documents were opened rather than counted, and databases checked for structural consistency. The client received a folder structure they recognised, with a manifest listing the small number of items that could not be returned.
Redundancy is not backup, and no RAID level protects against a person. If deletion by someone with access is a risk you carry — and every business with staff carries it — the answer is scheduled snapshots plus a copy the person cannot reach. Synology has snapshot functionality built in, it costs nothing to enable, and it would have made this an afternoon’s work instead of eleven days.
And if you suspect a deliberate deletion, stop using the device immediately and say so when you call. It changes the handling from the first hour, and preserving the position costs nothing.
RAID and NAS recovery is from £500 +VAT; forensic examination and reporting from £800 +VAT where you need findings that will stand up.
Drop the drive at our Oxford Street reception, or post it to us — it costs nothing to find out what happened. You get a written figure from the fixed bands before any work begins.