V2EX User Recovers NAS Files Using SSD Cache After Ransomware Attack

On November 5, 2026, a user posted on V2EX reporting that their Synology NAS was hit by ransomware during a business trip, leaving nearly every file on the device encrypted. The affected process had already exited, and nothing seemed salvageable at first. After conventional recovery attempts failed, the user realized their NAS had two solid-state drives installed as cache. They scanned the cache with AI and found hundreds of GB of data still sitting there, with one drive at 70% usage and the other at 30%. The user then ran an AI-driven directory generation pass, producing a CSV file, and discovered that all the more important files were listed inside. Extraction is now underway, with an estimated hundreds of GB more to pull out. The poster says they plan to reset the NAS and the drives once extraction finishes, and they are using the incident to remind others to keep a 3-2-1 backup strategy with off-site cold backups. They also mentioned having set up a one-way cloud cold backup for their most critical files afterward, at considerable cost. As of the post, extraction was still in progress and had not yet completed.