ASUSTOR NAS Data Recovery
ASUSTOR Lockerstor and Drivestor NAS data recovery for ADM firmware crashes, Deadbolt ransomware, degraded RAID arrays, and failed storage pools. ASUSTOR uses Linux mdadm software RAID with Btrfs or EXT4 filesystems. We image every member through a write-blocker and reconstruct offline. Free evaluation. No data = no charge.
Lockerstor and Drivestor Series
ASUSTOR organizes its NAS lineup into performance tiers. The Lockerstor line targets prosumers and small businesses with Intel processors and 2.5GbE or 10GbE networking. The Drivestor line targets home users and budget deployments with Realtek processors.Lockerstor Series
- Models: AS6604T (4-bay), AS6704T (4-bay Gen 2).
- RAID: RAID 0, 1, 5, 6, 10, JBOD. Factory default varies by model.
- Filesystem: Btrfs or EXT4 (user-selected during volume creation on ADM 3.3+).
Drivestor Series
- Models: AS1104T (4-bay budget), AS3304T (4-bay mid-range).
- RAID: RAID 0, 1, 5, 6, 10, JBOD. Same mdadm layer as Lockerstor.
- Filesystem: EXT4 on AS11xx models. Btrfs available on AS33xx with ADM 3.3+.
What is inside an Asustor ADM 4.x volume?
Asustor Data Master (ADM) 4.x is not a proprietary stack. It runs standard Linux mdadm software RAID, the Linux LVM volume manager, and either ext4 or Btrfs. The on-disk metadata is portable to any Linux workstation once the member drives are imaged.- mdadm software RAID: ADM groups the data partitions of every member drive into a Linux mdadm array, typically /dev/md1. The mdadm 1.2 superblock lives at a 4 KiB offset from the start of the partition, the same format used by Synology DSM and QNAP QTS. Recovery on a Linux workstation uses mdadm --assemble --readonly against the imaged members.
- LVM volume manager: Between the md device and the filesystem, ADM places a Linux LVM2 layer. The mdadm array is the LVM physical volume, the storage pool is the volume group, and each ADM volume is a logical volume. An engineer activates the group with vgchange -ay on the cloned array before the filesystem can be mounted.
- ext4 or Btrfs on top: Legacy ADM defaulted to ext4. ADM 3.3 introduced Btrfs and Snapshot Center; ADM 4.0 carried that forward with kernel-level stability improvements.
Btrfs is supported on Lockerstor and on the AS33xx Drivestor models. Btrfs adds checksums and copy-on-write snapshots used by Snapshot Center. The choice is recorded at volume creation and cannot be changed in place.
The practical implication: a dead Asustor chassis is not a barrier to recovery. Once each member is imaged through a write-blocker, the entire stack reassembles on a vanilla Linux workstation without an Asustor unit in the loop.
How does ADM compare to Synology DSM and QNAP QTS?
All three consumer NAS operating systems sit on the same Linux mdadm and LVM foundation. The differences are at the filesystem and snapshot layer. QNAP QuTS hero is the outlier: it replaces the entire stack with ZFS.| NAS OS | RAID engine | Volume manager | Primary filesystem | Snapshot mechanism |
|---|---|---|---|---|
| Asustor ADM 4.x | Linux mdadm | LVM2 | Btrfs or ext4 | Btrfs subvolume (Snapshot Center) |
| Synology DSM 7.x | Linux mdadm | LVM2 | Btrfs or ext4 | Btrfs subvolume (Snapshot Replication) |
| QNAP QTS 5.x | Linux mdadm | LVM2 (thin pool) | ext4 | Block-level LVM thin snapshots |
| QNAP QuTS hero | ZFS | ZFS | ZFS | Native ZFS snapshots |
Common ASUSTOR NAS Failure Modes
- ADM Firmware Crash: A failed ADM update can leave the NAS unable to boot or stuck in an initialization loop. ADM runs on the system partition, separate from data volumes. Your data is intact on the member drives.
- Deadbolt Ransomware (February 2022): Deadbolt targeted ASUSTOR NAS devices through known ADM vulnerabilities, encrypting user files with AES and demanding Bitcoin payment. Files receive a .deadbolt extension. Recovery depends on whether a decryption key was obtained or whether pre-attack snapshots exist on the Btrfs volume.
- Storage Pool Degraded: One or more member drives have dropped out. ADM will prompt you to rebuild.
If remaining members have weak sectors, a rebuild can push them past failure. Power down instead of rebuilding.
- Volume Inaccessible After Power Loss: Sudden power loss during a write operation can leave the Btrfs or EXT4 journal in an inconsistent state. ADM may report the volume as inaccessible or suggest formatting. Do not format.
Do not reinitialize. ADM prompts to create a new storage pool or format drives will overwrite the RAID superblocks and filesystem metadata needed for recovery. Power down, label drives, and contact us.
What happens when a Lockerstor NVMe cache drive drops off the PCIe bus?
- The cache sits in front of the HDD array: ADM lets you assign a Lockerstor M.2 NVMe SSD as a write-back (dirty) cache. New writes land on the fast NVMe first and get flushed down to the mdadm software RAID and Btrfs filesystem on the mechanical drives afterward.
- A dirty cache dropout strands those writes: When a consumer NVMe controller panics, thermal throttles, or loses the PCIe link under sustained write load, the writes still sitting in the cache never reach the platters. They are gone. The HDD array is left holding an incomplete, internally inconsistent Btrfs filesystem, and ADM reports the volume as crashed or inaccessible while every HDD is mechanically fine.
- It is the same mechanism Synology's DS920+ exhibits: This failure chain is documented on Synology Plus prosumer models such as the DS920+, DS1520+, and DS1621+, where an NVMe dirty write cache dropout triggers a "Volume Crashed" error in DSM. The architecture is identical because both vendors put a consumer NVMe write-back cache in front of an mdadm plus Btrfs HDD array on standard Linux. See our Synology recovery page for the same write-cache failure on DSM.
Recovery direction: power down and do not let ADM rebuild or reinitialize. We image each HDD member through a write-blocker, reassemble the mdadm array read-only on a Linux workstation, and forensically extract the Btrfs filesystem with btrfs-find-root and btrfs restore. The writes that were stranded in the dead NVMe cache are gone; everything already committed to the platters comes back.
Snapshot Center restore or offline reconstruction: which path applies?
- If the Btrfs snapshot metadata is intact
- When Snapshot Center auto-protection snapshots are still present and not corrupted, a read-only snapshot rollback is the cleaner, faster path. The historical Btrfs generation roots are still walkable, so you restore from those snapshot subvolumes rather than rebuilding the live tree. Newer ADM emphasizes scheduled and automatic Btrfs snapshot protection, which is exactly what makes this path possible.
- If the snapshots are corrupted, deleted, or scrubbed
- If the ransomware or a crash corrupted the snapshots and they are gone, offline read-only forensic recovery from cloned images is required. We image each member, use btrfs-find-root to locate a surviving older generation tree root, and run btrfs restore to extract data without writing to the array. This is the same clone-first discipline we apply to any RAID array reconstruction.
- Never treat btrfs check --repair as a safe fix
- Do not run btrfs check --repair or mount -o recovery,ro as an in-place repair. Btrfs is copy-on-write: it never overwrites a block in place, it writes a new version and updates a pointer. An in-place repair overwrites the very historical generation tree roots that forensic recovery depends on, which can turn a recoverable filesystem into an unrecoverable one.
How We Recover Data from an ASUSTOR NAS
ASUSTOR uses Linux mdadm for RAID management with the same superblock format found in Synology and QNAP devices. Recovery follows our standard image-first workflow.- Free evaluation: Document the ASUSTOR model, ADM version, RAID level, filesystem type, and failure symptoms. For Deadbolt cases, we assess encryption state and check for surviving snapshots.
- Write-blocked imaging: Each member drive is imaged through a hardware write-blocker using PC-3000 or DeepSpar. Mechanically failed drives receive head swaps in our clean bench before imaging.
- RAID reconstruction: mdadm superblocks from the member images provide stripe size, parity rotation, and member order. Data Extractor Express RAID Edition assembles the virtual array from clones.
- Filesystem extraction: Btrfs subvolumes and snapshots or EXT4 journal replay and inode reconstruction. Files are extracted, verified, and copied to target media.
- Delivery: Recovered data shipped on your target drive. Working copies purged on request.
Why do Asustor MyArchive drives fail in USB enclosures?
MyArchive turns internal Asustor SATA bays into hot-swap removable archives formatted as ext4, Btrfs, or NTFS. Inside an Asustor expansion unit such as the AS6004U, those bays route through a JMicron or ASMedia class USB-to-SATA bridge. The bridge, not the platter, is the most common source of corruption.- Bridge resets corrupt the journal: A JMicron or ASMedia bridge that resets mid-write drops the sectors that were in flight. On Btrfs or ext4, those sectors are routinely journal blocks. The platter is healthy. The filesystem is not.
- Hot pulls orphan the chunk tree: Pulling a MyArchive drive before the Linux page cache flushes orphans inodes on ext4 and breaks the Btrfs chunk tree that maps logical addresses to physical extents. Btrfs mount commands return open_ctree failed; ext4 forces a read-only remount.
- MyArchive AES is bound to the chassis: If you enabled MyArchive AES-256 encryption, the keys are managed inside the ADM environment. A shucked MyArchive drive plugged into a Windows machine returns ciphertext. Standard Windows recovery utilities will not see a filesystem and will offer to initialize the disk, which overwrites the Btrfs superblock or the LVM header on the next click.
- Windows Initialize Disk is destructive: Windows does not understand Btrfs or ext4. Connecting a MyArchive drive over USB and accepting the Initialize prompt writes a new partition table on top of the existing one. The data is still on the platters; the map to it is gone.
If a MyArchive volume will not mount, power the chassis down, label the source bay slot, and ship the drive. Do not insert it into a Windows PC and do not let any prompt that mentions Initialize, Format, or Repair run.
What do ADM, Snapshot Center, MyArchive, and DOM mean?
- Asustor Data Master (ADM)
- The Linux-based NAS operating system on every Lockerstor and Drivestor. ADM is the graphical layer over the mdadm, LVM, and Btrfs or ext4 stack. The on-disk format is standard Linux, not proprietary.
- Snapshot Center
- A GUI front-end for Btrfs subvolume snapshots. Snapshots are copy-on-write. They live on the same Btrfs filesystem as the source data and share blocks with the original until those blocks change.
- MyArchive
- A bay role that lets an internal SATA bay behave as hot-swap removable storage. MyArchive drives carry an independent ext4, Btrfs, or NTFS filesystem, optionally protected by AES-256 keyed to the ADM environment.
- Disk on Module (DOM) and eMMC
- A small internal flash chip on the Asustor mainboard, typically 2 to 8 GB. It holds the bootloader and the factory setup environment only. The full ADM operating system is mirrored across every member drive on a RAID 1 system partition called md0.
What does each Asustor LED state mean?
Front-panel LEDs are the first diagnostic before any drive comes out of the chassis. Lockerstor (AS66xx, AS67xx) and Drivestor (AS11xx, AS33xx) share the same LED grammar.- Power LED: Steady means the chassis is on. Flashing means the unit is waking from S3 sleep or completing early boot.
- System Status LED: Flashing green means the ADM kernel is initializing. Steady green means boot complete and healthy.
Steady red, or a dim intermittent red flash, means a critical fault: degraded RAID, crashed volume, or hardware error. Steady orange means sleep mode. If the LED flashes green for more than ten minutes with no drives inserted, the eMMC bootloader, RAM, or system partition is corrupt.
- Hard Disk LED, per bay: Steady green means the drive is ready. Flashing green means I/O is in progress. Steady red means the mdadm controller has ejected the drive, usually for media errors or for an SMR garbage-collection stall that exceeded the standard 30 second Linux block layer SCSI timeout.
Triage cross-reference: red system LED plus one red HDD LED points to a single failed member and a degraded array; power down before any rebuild prompt. Red system LED with all green HDD LEDs points to a logical volume crash where the drives are physically healthy and the filesystem is the problem. An endless flashing green system LED with no drives inserted points at eMMC, RAM, or md0 system partition damage.
ASUSTOR NAS Recovery Pricing
Two-tiered pricing: per-member imaging fee plus an array reconstruction fee. If we recover nothing, you owe $0.Member Imaging
Logical/firmware per drive
$250–$900
Array Reconstruction
mdadm + Btrfs/EXT4 extraction
Quoted after evaluation
Mechanical Member
Clean-bench head swap per drive
$1,200–$1,500
ASUSTOR member-drive recovery is hard drive recovery. Each drive we pull from your Lockerstor or Drivestor is imaged & recovered at the standard per-drive hard drive tiers below, & those per-member figures roll into the imaging fee above.
- Low complexity
Simple Copy
Your drive works, you just need the data moved off it
Functional drive; data transfer to new media
Rush available: +$100
$100
3-5 business days
- Low complexity
File System Recovery
Your drive isn't recognized by your computer, but it's not making unusual sounds
File system corruption. Accessible with professional recovery software but not by the OS
Starting price; final depends on complexity
From $250
2-4 weeks
- Medium complexity
Firmware Repair
Your drive is completely inaccessible. It may be detected but shows the wrong size or won't respond
Firmware corruption: ROM, modules, or translator tables corrupted; requires PC-3000 terminal access
CMR drive: $600. SMR drive: $900.
$600–$900
3-6 weeks
- High complexity
Most Common
Head Swap
Your drive is clicking, beeping, or won't spin. The internal read/write heads have failed
Head stack assembly failure. Transplanting heads from a matching donor drive on a clean bench
50% deposit required. CMR: $1,200-$1,500 + donor. SMR: $1,500 + donor.
50% deposit required
$1,200–$1,500
4-8 weeks
- High complexity
Surface / Platter Damage
Your drive was dropped, has visible damage, or a head crash scraped the platters
Platter scoring or contamination. Requires platter cleaning and head swap
50% deposit required. Donor parts are consumed in the repair. Most difficult recovery type.
50% deposit required
$2,000
4-8 weeks
Hardware Repair vs. Software Locks
Our "no data, no fee" policy applies to hardware recovery. We do not bill for unsuccessful physical repairs. If we replace a hard drive read/write head assembly or repair a liquid-damaged logic board to a bootable state, the hardware repair is complete and standard rates apply. If data remains inaccessible due to user-configured software locks, a forgotten passcode, or a remote wipe command, the physical repair is still billable. We cannot bypass user encryption or activation locks.
No data, no fee. Free evaluation and firm quote before any paid work. Full guarantee details. Head swap and surface damage require a 50% deposit because donor parts are consumed in the attempt.
- Rush fee
- +$100 rush fee to move to the front of the queue
- Donor drives
- Donor drives are matching drives used for parts. Typical donor cost: $50–$150 for common drives, $200–$400 for rare or high-capacity models. We source the cheapest compatible donor available.
- Target drive
- The destination drive we copy recovered data onto. You can supply your own or we provide one at cost plus a small markup. For larger capacities (8TB, 10TB, 16TB and above), target drives cost $400+ extra. All prices are plus applicable tax.
The prices above are for standard hard drives, which covers most jobs. Helium-sealed drives (for example WD or HGST Ultrastar He and Seagate Exos X) must be resealed and refilled with helium in-house after the chamber is opened, so they price higher, in the $200–$5,000+ range. See helium drive pricing.
No Data = No Charge. If we cannot recover usable data from your ASUSTOR NAS, you owe nothing.
ASUSTOR NAS Recovery FAQ
Can you recover data after an ASUSTOR ADM firmware crash?
Can you recover data after Deadbolt ransomware on an ASUSTOR NAS?
Does my ASUSTOR NAS use Btrfs or EXT4?
My Lockerstor NVMe cache drive dropped off and the volume crashed. Are the HDDs lost?
Should I use ASUSTOR Snapshot Center to roll back, or send the drives for offline recovery?
Can I move ASUSTOR drives to another NAS after a failure?
Data Recovery Standards & Verification
Our Austin lab operates on a transparency-first model. We use industry-standard recovery tools, including PC-3000 and DeepSpar, combined with strict environmental controls to maintain drive integrity. This approach allows us to serve clients nationwide with consistent technical standards.
Open-drive work is performed in a ULPA-filtered laminar-flow bench, validated to 0.02 µm particle count, verified using TSI P-Trak instrumentation.
Transparent History
Serving clients nationwide via mail-in service since 2008. Our lead engineer holds PC-3000 and HEX Akademia certifications for hard drive firmware repair and mechanical recovery.
Media Coverage
Our repair work has been covered by The Wall Street Journal and Business Insider, with CBC News reporting on our pricing transparency. Louis Rossmann has testified in Right to Repair hearings in multiple states and founded the Repair Preservation Group.
Aligned Incentives
Our "No Data, No Charge" policy means we assume the risk of the recovery attempt, not the client.
Technical Oversight
Louis Rossmann
Our engineers review all lab protocols to maintain technical accuracy and honest service. Since 2008, his focus has been on clear technical communication and accurate diagnostics rather than sales-driven explanations.
We believe in proving standards rather than just stating them. We use TSI P-Trak instrumentation to verify that clean-air benchmarks are met before any drive is opened.
See our clean bench validation data and particle test videoRelated services
Related Recovery Services
All NAS brands: Synology, QNAP, Buffalo, WD My Cloud & more.
RAID 0, 1, 5, 6, 10 array reconstruction from failed members.
Head swaps, firmware rebuilds, & platter recovery for NAS member drives.
Dell, HP, & Supermicro rackmount server recovery.
LUKS, BitLocker, & hardware-encrypted NAS volumes.
ASUSTOR NAS down? Start a free evaluation.
Ship your drives or walk in at our Austin lab. No data = no charge.