The short answer: An annual NAS service inspection checks every disk individually (SMART data, operating hours and log errors), the health of the array and volume, storage growth, DSM or QTS patches including packages, snapshots and backup versions, an actual restore test, the UPS and who has access to the device. It does not replace backups or continuous monitoring. It does, however, reveal whether the business is relying on protection that would fail when it is needed most.
A green status light does not mean you can restore yesterday’s accounts
A business NAS often runs unattended for years. It only receives attention when it starts beeping, a shared folder disappears or the array switches to a „Degraded„ state. Yet a „Healthy" status in Storage Manager says nothing about whether a separate backup exists, whether the device has current security patches or who can sign in to it from the internet.
An annual inspection should answer three questions: what could fail, whether a usable copy of the data exists and what needs to be done first. It is not a preventive rubber stamp. It is an assessment of the system’s technical condition, security and actual recoverability.
What the business should receive after the inspection
The outcome should not be a sentence saying, „The NAS is fine." A useful report includes the device model and serial number, system version, health of each disk and array, capacity usage, update status, backups, snapshots and UPS, and a list of accounts with access. Each finding should include evidence such as a log, version or test result, together with its severity and a recommended next step.
The required level of access should be agreed in advance. A technician does not need to read the contents of company documents to inspect the storage system. They should receive their own temporary service account, ideally accessed through a VPN and protected by multi-factor authentication. The account should be disabled after the work is complete, and the login records should be reviewed.
The inspection must not change firmware, start a rebuild or delete snapshots without approval. On a degraded array, even an apparently routine action can increase the load on the remaining disks. The current state should be captured and the risk assessed before any changes are planned.
1. SMART data, disk health and actual age
Every disk is checked individually on Synology DiskStation and RackStation systems, as well as on QNAP devices running QTS or QuTS hero. An overall „Healthy" status is not enough. We look at the exact model, serial number, firmware, operating hours, temperature and test history, and especially at trends in attributes that indicate deterioration: reallocated, pending and uncorrectable sectors, and interface errors (CRC).
A single value without any history does not show whether the condition is getting worse. A disk may also pass a short SMART test while repeatedly dropping out of the array because of cabling, power issues or the time it spends trying to read a bad sector. SMART data must therefore always be compared with the NAS system log. The article A disk keeps dropping out of the NAS even though it is healthy examines this issue in detail.
The suitability of the installed drives is also checked. WD Red Plus and Red Pro, Seagate IronWolf and IronWolf Pro, and Toshiba N300 are NAS drive ranges, while WD Purple is intended for video surveillance recording. Particular attention should be paid to older WD Red drives without the Plus designation, such as the WD20EFAX, WD40EFAX and WD60EFAX. These use SMR recording and may behave unpredictably during a rebuild. The article SMR drive in a NAS: why it drops out of the array explains how to identify such drives by model number.
Age is not assessed from the NAS purchase date. Drives replaced in different years will have different operating hours. The report therefore does not prescribe a universal „replacement age." Instead, it identifies specific drives, error trends and the impact that their failure would have on the particular type of array.
2. RAID, storage pool and volume health
The second part of the inspection determines whether the data is currently protected in the way the business expects. Synology distinguishes between a Storage Pool and a Volume, while QNAP uses RAID Groups, Storage Pools and Volumes. „Degraded,„ „Crashed" and „Read-Only" are different states and require different responses.
The inspection covers the number of active disks, missing members, incomplete rebuilds, hot-spare status and the history of disconnections. It also verifies whether the array matches the company’s documentation: SHR, RAID 1, RAID 5, RAID 6 or RAID 10. RAID maintains availability when a certain number of disks fail. It cannot restore a deleted folder or protect against administrator error, ransomware or fire.
If the array is degraded, the inspection becomes fault diagnosis. Clicking „Repair" is not a safe first step. The remaining disks and the backup must be assessed first. The article Synology and QNAP report a volume problem: when to click Repair explains when the button should and should not be used.
3. Free capacity and growth rate
A statement such as „2 TB remaining" means nothing without context. That capacity might last for years or only weeks. The inspection therefore examines usage by volume, data growth between available records and the proportion consumed by snapshots, shared-folder recycle bins, computer backups and application data.
The aim is to estimate when the system will run out of space at the current growth rate and identify what is consuming it. Deleting snapshots simply to clear an alert is a bad idea: it may remove the last quick route back to an earlier version of a file.
4. DSM, QTS and security patches
Recording only the main DSM or QTS version is not enough. The inspection separately checks whether the specific model still receives security updates and reviews the versions of installed packages such as Hyper Backup, HBS 3, Snapshot Replication, Photo Station and Container Station.
Campaigns targeting QNAP devices have shown why package updates matter. In 2021, Qlocker exploited an already patched HBS 3 vulnerability on devices that had not been updated, placed files in password-protected 7z archives and deleted snapshots (QNAP’s description of and response to Qlocker). One wave of DeadBolt targeted internet-exposed devices through a vulnerability in Photo Station. The lesson is the same in both cases: close services that do not need to be exposed and update both the operating system and its packages. The article Ransomware on a NAS: Qlocker, DeadBolt and data recovery explains what to do after an attack.
The inspection covers router port forwarding, UPnP, QuickConnect or myQNAPcloud, remote administration, VPN access, the NAS firewall and services that nobody uses. Updates should not be installed blindly. Model support, the configuration backup and package compatibility must be verified first.
5. Snapshots, backups and the number of usable versions
A snapshot and a backup are not the same thing. A snapshot on the same NAS can quickly restore a file or folder to an earlier state, but it shares some of the storage system’s risks. If an attacker gains administrator access or the entire device fails, the snapshot may be lost as well.
For backups, the inspection checks the destination, the most recent successful run, error history, retention and the number of available versions. Synchronisation to the cloud or a second NAS is not necessarily a backup: deletions or encrypted files may be replicated there as well. You need a separate copy that an account compromised on the original NAS cannot overwrite or delete.
The inspection therefore does not merely answer whether „the job completed." It establishes the dates and number of recovery points available. It also checks the NAS configuration backup and determines where passwords and keys for encrypted backups and folders are stored.
6. A restore test, not a screenshot saying „Success"
A green backup-job log confirms that data was transferred, not that the result is usable. During a test, selected data is restored to a separate location and opened. For an accounting or warehouse-management database, the restored copy is launched and checked to confirm that it can actually be used. Production data remains unchanged.
The test record states the date, source, destination, scope, result, recovery time and the person who evaluated it. Providers of regulated services subject to the higher-obligations regime are also legally required to perform these tests: § 26 odst. 3 vyhlášky č. 409/2025 Sb., o bezpečnostních opatřeních poskytovatele regulované služby v režimu vyšších povinností requires regular testing of backup integrity, availability and recoverability, together with documentation of the results (official text in e-Sbírka).
For other small businesses, even where it is not mandatory, this answers the most expensive unknown: can work continue after a failure? The article Backup restore testing: how to perform and document it describes the procedure step by step. The inspection verifies whether such a test exists and when it was last demonstrably successful.
7. UPS and safe shutdown
A UPS requirement is not satisfied merely because a box with a battery is sitting beneath the NAS. The inspection covers the battery’s age and reported condition, the latest self-test, the load, communication over USB or the network, and the NAS safe-shutdown configuration. Where several devices are involved, it also verifies which one sends the shutdown signal and whether the second NAS shuts down correctly.
Testing does not mean pulling the power cable from a running array. It should be planned for a maintenance window. The purpose is to discover a dead battery or missing data connection before a storm does. The article NAS failed to start after a storm or power outage explains what to do if the NAS does not start after a power failure.
8. Who has access and what they left behind
The inspection looks for shared administrator accounts, accounts belonging to former employees, an active default „admin" account, supplier accounts without a designated owner and access without multi-factor authentication. Permissions on shared folders are checked to ensure they match each person’s job role.
An external administrator should not have a permanent password known to several people. A sensible model uses a named account, VPN access, restricted permissions, MFA and login records. The business must know who holds the recovery codes and how it can regain administrative control if the supplier is unavailable.
How to recognise a high-quality report
A useful report separates findings from recommendations. Each item states the condition, evidence, impact, priority, task owner and deadline. Passwords and recovery keys do not belong in the report.
- Red indicates an immediate risk, such as a degraded array without a verified backup.
- Amber indicates an issue that can be planned for, such as diminishing capacity or an unsupported package.
- Green must be supported by a version, log or test rather than the technician’s impression.
The handover should also list what was not checked. Without a restore test, nobody can claim that the backup works. Without access to the router, nobody can confirm that the NAS is not exposed to the internet.
How much does an inspection cost, and who performs it?
The price depends on the number of devices and arrays, the quality of the documentation, the access method, the scope of the restore test and whether the work is a planned inspection or diagnosis of a system already reporting an error. It should be clear in advance whether the price covers only the inspection and report or also approved repairs. Drive replacement, capacity expansion, migration and new backup storage are separate scopes of work.
If you do not want to inspect the NAS yourself, we can carry out the work in Brno and the surrounding area as part of our NAS servicing in Brno, where you can also find our current service pricing. Continuous monitoring of updates, capacity, backups and incidents is available through our IT management for businesses.
Why once a year, and when not to wait
Once a year is a sensible minimum for a comprehensive inspection of a device that nobody manages continuously. However, an inspection does not replace monitoring: a failed disk, unsuccessful backup or full volume must be addressed when the problem occurs. The article IT monitoring: what a small business should monitor summarises what should be tracked continuously.
Do not wait for the annual inspection if the NAS reports a Degraded or Read-Only state or a volume error, repeatedly beeps, disconnects a disk, has stopped backing up, is directly accessible from the internet or no longer receives updates. Do not blindly start a rebuild, file-system repair or firmware update. If the array has already failed and the data exists nowhere else, the situation requires data recovery. A basic initial assessment of a RAID or NAS system may be free, while analysing multiple disks and reconstructing an array is generally paid work; you will receive the price before the work begins.
FAQ
Is checking the NAS once a year enough?
A comprehensive service inspection once a year makes sense. Critical alerts, failed backups, capacity and disk health should be monitored continuously; an annual schedule is no reason to postpone a reported fault.
If DSM or QTS shows „Healthy," is the data safe?
Not necessarily. The status says nothing about a separate backup, recoverability or remote-access settings. SMART data, logs, array health, backup versions and the restore-test result must be considered together.
Does a service inspection replace a backup?
No. The inspection determines whether a backup exists, contains usable versions and can be restored. It does not create a second, separate copy of the data.
Can a NAS inspection be performed remotely?
Most configuration, log, update, account and backup-job checks can be performed remotely over a secure connection. The physical condition, cabling, UPS and some disk faults require an on-site inspection.
What should I do if the array is already Degraded?
Limit write activity and check the health of the remaining disks and the backup first. Do not automatically start Repair, a rebuild, a scrub or an update. The correct procedure depends on the array type, the cause of the failure and the condition of the other disks.
Where to find us
ITHOPE is a company based in Brno, Czechia: we do data recovery from disks, RAID and NAS, PC and laptop service and IT for business, all in our own lab at Viniční 3587/216, 615 00 Brno.
Phone +420 775 556 063 (24/7 line). You can bring the device in person, or send it by courier (Zásilkovna, PPL).