Solved

Synology Diskstation ds213 File Corruption

Posted on 2014-04-22
20
1,826 Views
Last Modified: 2014-05-06
I have a diskstation DS213 with 2 500GB Drives Mirrored. This is connected via the network to 2 windows 7 pro boxes.  Today i noticed on one of the shares that a bunch of Randomnumber.tmp files  with different file sizes also majority of the word docs have 0 kb sizes. It looks like something got corrupted where the word docs are now the tmp files. I tried to open one of the tmp files and i see some writing but a lot of ASCII characters. I also noticed files in the recycle bin of the diskstation that shouldnt be there. I checked the logs and didnt see anything related. THe drives are good no errors.

Any suggestions on what could of caused this?

 ALso is there a way to enable auditing in these devices?
0
Comment
Question by:noclav
  • 9
  • 5
  • 4
  • +2
20 Comments
 

Expert Comment

by:gempa
Comment Utility
Watching
0
 
LVL 4

Expert Comment

by:sconnell
Comment Utility
I don't believe it is your Synology (fantastic hardware BTW) at fault but rather, I am guessing (hoping) that your Word has its temp file folder on the Synology.

In other words,  I am guessing that these .tmp files were created by Word (or other programs). Disk corruption doesn't create .tmp files and Synology has better than average disk protection and logs (if your Synology's health is good, rest assured there are no problems).

See: http://support.microsoft.com/kb/211632

And check your Office programs settings (I suggest using a local drive for the dreaded temp files).

Good luck
0
 

Author Comment

by:noclav
Comment Utility
word tmp files usually contains the ~ in the file name i attached a pic. This happened yesterday afternoon was fine till then. To protect the customer info i deleted the files names but that shouldnt matter.
diskstationissue.jpg
0
 
LVL 4

Expert Comment

by:sconnell
Comment Utility
You are correct but I can assure you that these are not as a result of disk errors. Some program is saving these files. Are you able to correlate the times/dates of these tmp files?

To be certain, however, run a full Synology diagnostic.
0
 
LVL 37

Expert Comment

by:Gerwin Jansen
Comment Utility
Can you run some anti-malware like MBAM on both Win7 machines? Do a quick scan first. Anything found?
0
 
LVL 4

Expert Comment

by:sconnell
Comment Utility
Although it never hurts to run a malware scanner, these tmp files are unlikely the result of malware.

A couple of things to look at:
- check the properties of the tmp files. You should be able to determine who created them (owner).
- how large are the files?
- occasionally, opening the files (in a program like Notepad ++) will reveal the program that created the files (if you sift through the unreadable data). But don't use Windows Notepad.
0
 

Author Comment

by:noclav
Comment Utility
do you know where in notepad++ to find out who created these files.
0
 
LVL 4

Expert Comment

by:sconnell
Comment Utility
>do you know where in notepad++ to find out who created these files.

No place in particular, you just need to look carefully at the text in order to deduce the likelihood of which program created the tmp files. I'm not claiming that this is always possible but many tmp files do include clues.

How large are the files? If they are very large, this might be a near impossible task.
0
 

Author Comment

by:noclav
Comment Utility
all TMP file sizes are under 1M i looked at the properties of one tmp file and it said the owner was Unix\1028
Computer DISKSTATION.
So this would tell me that the synology box is creating these. I ran a few virus scanners on both machines and they came up clean.
0
 
LVL 4

Expert Comment

by:sconnell
Comment Utility
Interesting.
Are you running any Synology or 3rd party apps? If so, which ones?
0
What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 

Author Comment

by:noclav
Comment Utility
no third party apps just the default apps that came with the unit.
0
 
LVL 25

Expert Comment

by:kode99
Comment Utility
Go into the DSM Control Panel - > File Services on ver 5 or Win/Mac/NFS on ver 4.

On the windows file service tab or section there is a option to 'Enable Transfer Log'

Check this and apply.  This will log all windows related file activity including the IP and user etc.  This should allow you to pinpoint exactly where these files are coming from next time they turn up.

Definately look like something's temporary files.  A diskstation with no extra apps running is not going to produce these.

Only time I've seen malware produce something like this is when it renamed users files with random unique names.  If you looked at those they were still intact - just very annoying to fix.
0
 

Author Comment

by:noclav
Comment Utility
i did already enable that earlier to see if this happens again. Here is what i found so far . If i rename the tmp file to a doc file it opens fine in word. So maybe this is a bug with word 2013.
0
 
LVL 25

Expert Comment

by:kode99
Comment Utility
You would likely also see that if somebody did a hard power down while stuff was open in word since it can't clean up after itself.  Or any other situation that does not programs to clean up their temp files.

Probably also see a bunch of tmp in the network recycle bin (if its in use) if word is using the network drive for tmp files (or other programs for that matter).

Definitely not a issue with the Synology unit itself.
0
 

Author Comment

by:noclav
Comment Utility
here is an update, There is a few issues, one is that these word docs are being converted to tmp files, 2nd files are automatically being moved and removed from the recycle bin in the diskstation, 3rd i created a txt file named test.txt with jibberish and saved it to the mapped drive pointed to the diskstation, after a few min the file name changed to new text file.txt i checked the task scheduler and no tasks exist.
0
 
LVL 25

Expert Comment

by:kode99
Comment Utility
Check the transfer log activity and see what it says made the changes.

So you used notepad to make 'test.txt' and after a bit of time the file changed to 'new text file.txt' ?
0
 

Author Comment

by:noclav
Comment Utility
in the log it shows that the user renamed it and i know for a fact i did not rename it. I think now this has to do with the Diskstation. Here is another thing i found. I emptied the recycle bin from the diskstation then unchecked enable recyclebin and then reenabled it. I then opened a few word docs for ex share\clients\client1\doc1.doc and doc2.doc
then i closed them and opened the recycle bin and i saw a folder named clients\client1 and was empty. Why the folder was created in the recyclebin is beyond me.
0
 
LVL 25

Expert Comment

by:kode99
Comment Utility
If the log shows a user it means that the user that was logged into the diskstation is the 'source' of the file activity.  It might not be done by the user personally but it means the action is initiated from the computer the user is logged into at the time .  Could be any process on the system doing it.

What version of DS are you using?

You could use Sysinternals Process Monitor on your windows system to see exactly what process is doing it.  It can be a bit overwhelming  lots of more basic file activity monitoring tools out there as well if you google it.

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx
0
 

Accepted Solution

by:
noclav earned 0 total points
Comment Utility
Here is what i did to resolve this. I performed a reset on the device and re installed the DSM software updates and reconfigured the device. It has been over 3 days and so far so good.
0
 

Author Closing Comment

by:noclav
Comment Utility
Only solution i found to resolve this.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

It’s 2016. Password authentication should be dead — or at least close to dying. But, unfortunately, it has not traversed Quagga stage yet. Using password authentication is like laundering hotel guest linens with a washboard — it’s Passé.
This article is an update and follow-up of my previous article:   Storage 101: common concepts in the IT enterprise storage This time, I expand on more frequently used storage concepts.
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

8 Experts available now in Live!

Get 1:1 Help Now