Recover deleted file on network drive

Posted on


it seems I’ve accidentally deleted some files from a network drive
(Western Digital NAS with proprietary OS, but probably Linux; used by 3 PCs with Windows XP and Windows 7).

Is there any way to revover the fiels?

Or at least, is there a way to see when and from which client/process the deletion was done? I cannot remember that I deleted a file, so at least I would like to know what happened.


You need block-level access to the hard drive. Since your NAS will most probably not give it to you over the network, this means removing the hard drives and attaching them directly to a computer (use linux and make sure it doesn’t write anything!). This should be done ASAP.

Depending on the file system, you may then use appropriate recovery tools. If the file was really important (like $1000 important), get data recovery firm do the work. If it is somewhat important (like hours of your time important), or if you like to learn stuff and don’t mind wasting your time, try some recovery tools appropriate for the file system. If there is any kind of RAID, good luck even getting to the file system. If the file system is ext3/ext4, you will need to try to recover data from the journal, as it wipes critical data structures.

Unless your NAS has some very unusual logging, you will not know from where the file was deleted, ever. You may be able to get the deletion date (block-level access required) using data recovery/forensic tools.

I doubt there are any tools you can run from your PC which will work on your NAS (unless your NAS is presented as a block device to your OS – this is not typically the case – they tend to use Windows filesharing or equivalent).

If you get “Block Level” access to the device, you may be able to run some recovery, but this is pretty hard, and nothing like a simple undelete or looking through your trash folder.

Leave a Reply

Your email address will not be published.