WD My Cloud, My Book & Red NAS Data Recovery
My Cloud EX2/EX4 Ultra, PR2100, PR4100, My Cloud Home, My Book Duo, WD Red Plus/Pro — WD specialists
My Cloud EX2/EX4 Ultra, PR2100, PR4100, My Cloud Home, My Book Duo, WD Red Plus/Pro — WD specialists
Three options tailored to your urgency and budget
| Model / Series | System / RAID | Common failures |
|---|---|---|
| My Cloud EX2 Ultra / EX4100 | EXT4 / RAID 0/1/5/JBOD | Flashing red LED, degraded RAID, failed firmware update, disk not detected |
| My Cloud Pro PR2100 / PR4100 | EXT4 / RAID 0/1/5/10 | System corruption after power cut, WD Red disk with damaged heads, NAS inaccessible via network |
| My Cloud Home / Home Duo | EXT4 / RAID 1 (Duo) | Proprietary system with no direct access, WD cloud service failure, internal disk failure, inaccessible data |
| My Book Duo / My Book Live | EXT4 / RAID 0/1 | My Book Live: CVE-2021-35941 vulnerability (remote wipe). My Book Duo: RAID 0 failure (total loss without prior clone) |
| WD Red Plus / WD Red Pro (NAS) | NAS drives | Bad sectors (realloc), heads damaged by vibration, firmware with translation table bug (SA corruption) |
| WD Sentinel DX4200 / DS6100 | NTFS / RAID 5/10 | Windows Storage Server NAS, hardware RAID controller failure, disk in SMART warning state |
Western Digital NAS devices use My Cloud OS 5 (based on Linux Debian) with an EXT4 file system on RAID configurations managed by mdadm. Their architecture presents specific failure modes that we know in depth.
The intermittent front red LED indicates a critical failure: degraded disk, RAID failure or operating system error. My Cloud OS does not display detailed diagnostics; the red LED is the only visible signal. Do not restart the NAS repeatedly: each forced boot can worsen the array state.
The NAS powers on but does not appear on the local network or respond to its IP. This can be due to system partition corruption (independent of data), Samba/AFP service failure, or a network configuration error stored in flash. Data is usually intact on the EXT4 RAID partitions.
My Cloud OS 5 replaced the older My Cloud OS 3. The firmware update can fail due to power cut, insufficient space or incompatibility. The NAS is left in a «bricked» state with no access to the web interface. Data remains on the data partitions, separate from the firmware, and is recoverable.
WD NAS devices with remote access enabled (port 443, WD relay) have been attack targets. The CVE-2021-35941 vulnerability in My Book Live allowed mass remote wiping. In these cases, recovery via EXT4 analysis and file carving offers high success rates.
My Cloud OS manages RAID via mdadm. An automatic rebuild on a degraded array can fail if the remaining disk has UREs (Unrecoverable Read Errors). The PR4100 with RAID 5 and 4 disks is particularly vulnerable: a second failure during rebuild = total loss without professional intervention.
WD SmartWare stores backups in a proprietary format (.swstor). If the NAS fails, these files can become orphaned. Direct extraction of .swstor files requires specific tools that interpret the backup metadata structure.
⚠ These mistakes can turn a viable recovery into total data loss:
Understanding the internal structure of WD NAS devices is essential for successful recovery:
Bit-for-bit image of each WD Red disk with DeepSpar Disk Imager. If the disk has damaged heads, prior cleanroom intervention in an ISO 5 facility to replace the head stack with a compatible one.
Analysis of the mdadm superblock to determine array geometry: stripe size, disk order, offsets. Complete virtual reconstruction on the images, never on the original disks.
Mounting the reconstructed EXT4 volume. File extraction with folder structure, permissions and timestamp preservation. Deleted file recovery via EXT4 journal analysis.
Data delivered on an external drive with a detailed report and listing of recovered files. Integrity verification via checksums. You only pay if we recover your data.
| Service | Description | Timeframe | Price |
|---|---|---|---|
| Logical | EXT4 corruption, firmware brick, lost partition, accidental deletion, My Cloud inaccessible | 4–12 days | €300–550 |
| Physical | Mechanical WD Red disk failure (heads, motor, SA), cleanroom intervention | 7–15 days | €600–1200 |
| Virtual RAID (+) | Virtual reconstruction of RAID 0/1/5 mdadm array from cloned images | 4–12 days | +€200 |
| Emergency | Top priority, extended business days. Subject to availability. | 24–72h | +50% |
Yes, the data partitions are standard EXT4 on mdadm. On a Linux system you can try assembling the array with mdadm --assemble --scan. However, if the array is degraded, the kernel may attempt an automatic reconstruction that worsens the situation. Always work on cloned images, never on the original disks.
Completely different. My Cloud Home uses an Android-based operating system with a proprietary abstraction layer. It has no SSH, no advanced management interface and does not allow manual RAID configuration. Data is stored on EXT4 partitions, but the folder structure is different (UUID-based). Recovery is possible by extracting the disk and reading the partitions directly.
In June 2021, thousands of My Book Live units were remotely reset by exploiting vulnerability CVE-2021-35941, an unauthenticated factory reset endpoint. The reset erased the partition table and reinitialised the disk. Recovery via forensic analysis of the EXT4 partition and file carving achieves 70-95% recovery rates depending on subsequent disk usage.
Standard WD Red (SMR) drives caused controversy in 2020 because they used Shingled Magnetic Recording (SMR) without disclosure. SMR has worse performance in random writes and RAID rebuilds. WD released Red Plus (CMR) and Red Pro (CMR, 7200 RPM) as alternatives. If your NAS uses SMR WD Red drives, RAID rebuilds are significantly slower and riskier. WD Red Pro are reliable and comparable to Seagate IronWolf Pro.
RAID 5 tolerates a single failed disk. With two failed disks, the array is unreadable directly. However, if the disks failed due to mechanical problems (not data corruption), cleanroom intervention to repair at least one of them allows the complete array to be reconstructed. Our success rate in these cases exceeds 80%.
RAID 1 is the most favourable case: data is duplicated on both disks. If at least one disk is readable, logical recovery takes 3-5 days. If both disks have mechanical damage, the DeepSpar cloning process can extend to 10-15 days, but the probability of success is very high because we only need one readable image from either disk.
Yes. WD Sentinel (DX4200, DS6100) uses Windows Storage Server with NTFS on hardware RAID (LSI/Broadcom controller). The process differs from My Cloud: we clone the disks, virtually reconstruct the hardware RAID array and access the NTFS volumes. We also recover data from shared folders, Active Directory and SQL Server databases stored on the Sentinel.
Urgent collection across Spain. Laboratory operational including weekends for emergency cases.
Do not power on the NAS, do not rebuild. Each attempt reduces recovery chances.
Free collection* within 24h · 4-hour diagnosis · No recovery, no fee
Practical guides, news and tips to protect your data. No spam.
Stay updated