Data Recovery Case File · NAS & Network Storage · Reachable Means Actionable
Nothing Failed. Something Reached It.
His enquiry describes an event rather than a fault, and he already knows he was one of many. A network drive "that appears to be one of the many devices globally that have been affected by a remote factory reset that has resulted in the loss of all data." No disk failed, no power event occurred, nothing wore out. A command arrived over the internet and the device did what it was told. The recovery outlook is better than the word "reset" suggests — and the lesson underneath is worth more than the recovery.
| Media | Single-disk network storage appliance — subjected to a remotely triggered factory reset in a mass incident affecting internet-reachable devices of the same model |
| Reported situation | Device reset remotely without owner action · contents no longer present · incident affecting many devices of the same model simultaneously · no hardware fault reported · device retained |
| Fault class | Factory reset writing new filesystem structures without erasing the data area — content recoverable pending overwrite |
| Equipment used | Device isolated from the network and left unpowered · disk removed and imaged write-blocked (Atola TaskForce 2) · reset extent measured against total capacity · previous filesystem structures located and rebuilt on the image · files validated by opening |
The decode: what a factory reset actually writes, and why that helps
What "factory reset" means on a device like this: it sounds total and it is not. The operation restores the appliance to its shipped configuration — clearing settings, accounts and shares, and creating a new empty filesystem on the storage. What it does not generally do is write over every sector of the disk, because that would take many hours on a large drive and serves no purpose from the manufacturer's point of view. The objective is a usable device, not a destroyed one.
Why that matters enormously here: a new filesystem written over an old one replaces the structures describing where files were, while leaving the files themselves physically present in the data area. So this is closer to a format than to an erase — and formats, throughout this archive, are among the more recoverable events.
What decides how much comes back: what has been written since. A device reset and then left alone retains everything. A device reset and then put back into service — reconfigured, shares recreated, files copied onto it again — has had new data written into exactly the space the old files occupy. The single most valuable thing he can do is leave it alone, unpowered and unused, which he appears to have done.
Why the old structures may also survive: filesystems keep backup copies of their key structures at known positions away from the start of the volume, and a newly created filesystem does not necessarily disturb them. Where one is found, files come back with folders and original names rather than as carved output.
Now the part that matters beyond this device. The reason thousands were affected simultaneously is that they were reachable from the internet — configured for remote access, on an unsupported model no longer receiving security updates, and therefore able to be instructed by anybody who found them. Nothing about the storage failed. A device that can be reached can be acted upon, and network storage exposed directly to the internet is exposed to everyone.
What follows practically: remote access to a network drive should go through a controlled route rather than direct exposure, unsupported models should not be internet-facing at all, and — the point this archive keeps returning to — a network drive is not a backup. It is one copy, reachable, and this incident is precisely what happens to one copy.
What not to do: not reconnect it to the network, not reconfigure it, and not copy anything onto it.
On the bench
The device was isolated from the network and left unpowered, since anything written after the reset consumes the space the previous contents occupy and the model remained reachable. The disk was removed and imaged write-blocked on the Atola TaskForce 2. The reset extent was measured against total capacity — establishing how much of the disk the operation had actually written, which is the figure determining what remains — and previous filesystem structures located and rebuilt on the image from their surviving backup copies. Files were validated by opening.
The outcome
The device isolated, the disk imaged and the previous filesystem rebuilt from its surviving structures. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode, for anyone whose device was remotely reset: a factory reset restores the shipped configuration and writes a new empty filesystem — it does not generally overwrite every sector, because that would take hours and serve no purpose. So your files are physically present with the description of them replaced, which is closer to a format than an erase. Leave it unpowered and connect nothing to it.
Network drive wiped by a remote reset
Leave it switched off and don't reconnect or reconfigure it — that's the only thing that decides how much comes back. A factory reset sounds total and isn't: it restores the shipped configuration and writes a new empty filesystem, but it doesn't generally go over every sector of the disk, because that would take hours and achieve nothing the manufacturer wants. Your files are still physically there with the description of them replaced, which makes this closer to a format than an erase. What removes them is new data written afterwards, so putting the device back into service is what would actually cost you. The wider lesson is worth taking too: this happened because the device was reachable from the internet, and anything reachable can be acted on.
Leave it off and off the network — call Newcastle Data Recovery on 0191 406 1051; disk imaged write-blocked, reset extent measured against capacity, previous filesystem rebuilt from surviving structures.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.