l0ck3d

Synology NAS powered off or rebooted: follow-up steps for L0CK3D

Keep the disks, snapshots, and other copies first, stop writing to the original disks, then assess the remaining recovery conditions. A reboot cannot recover earlier process memory, so do not attempt recovery on the original disks.

Content reviewed: 2026-10-30

Do not do these first

A restart cannot rebuild earlier process memory. Do not keep rebooting to "try your luck", do not run generic decryption, repair, cleanup, or recovery tools on the original disks, and do not delete ciphertext, snapshots, the recycle bin, or existing dumps.

Keep these materials

  • The original disks and existing memory dumps, swap partitions, or hibernation data.
  • Existing Btrfs snapshots and the snapshot list.
  • Intact copies of the same version on computers, phones, email, Git clones, and other locations.
  • Ransom notes, file extensions, discovery times, and records of the actions already taken.

Assess in order

  1. Check snapshots and independent copies first. If a usable original exists, verify its content first, then copy it to independent storage, and keep the original snapshots.
  2. If there is no usable key and the data volume is Btrfs, assess the old data block route. Btrfs copy-on-write may keep data blocks from before they were overwritten, but the actual result depends on block mapping, snapshots, and later writes. It cannot be judged from the Btrfs or NoCOW label alone.
  3. Run a small pilot first. Write the output to an independent device outside the source storage pool, and record the verification level for each file. Being able to open a preview does not mean it matches the original exactly.

Do not run balance, defrag, discard/TRIM, repair, or cleanup, and do not create or delete snapshots for experiments. File-level ciphertext copies do not contain all the filesystem metadata the old data block route needs. When necessary, have a professional assess the underlying forensics.

Sources: main rescue repository path after power-off (Chinese), Btrfs key-less recovery conditions and limits (Chinese).