[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2226
  • Last Modified:

Synology Diskstation ds213 File Corruption

I have a diskstation DS213 with 2 500GB Drives Mirrored. This is connected via the network to 2 windows 7 pro boxes.  Today i noticed on one of the shares that a bunch of Randomnumber.tmp files  with different file sizes also majority of the word docs have 0 kb sizes. It looks like something got corrupted where the word docs are now the tmp files. I tried to open one of the tmp files and i see some writing but a lot of ASCII characters. I also noticed files in the recycle bin of the diskstation that shouldnt be there. I checked the logs and didnt see anything related. THe drives are good no errors.

Any suggestions on what could of caused this?

 ALso is there a way to enable auditing in these devices?
0
noclav
Asked:
noclav
  • 9
  • 5
  • 4
  • +2
1 Solution
 
gempaCommented:
Watching
0
 
Shawn ConnellyTechnical WriterCommented:
I don't believe it is your Synology (fantastic hardware BTW) at fault but rather, I am guessing (hoping) that your Word has its temp file folder on the Synology.

In other words,  I am guessing that these .tmp files were created by Word (or other programs). Disk corruption doesn't create .tmp files and Synology has better than average disk protection and logs (if your Synology's health is good, rest assured there are no problems).

See: http://support.microsoft.com/kb/211632

And check your Office programs settings (I suggest using a local drive for the dreaded temp files).

Good luck
0
 
noclavAuthor Commented:
word tmp files usually contains the ~ in the file name i attached a pic. This happened yesterday afternoon was fine till then. To protect the customer info i deleted the files names but that shouldnt matter.
diskstationissue.jpg
0
A Cyber Security RX to Protect Your Organization

Join us on December 13th for a webinar to learn how medical providers can defend against malware with a cyber security "Rx" that supports a healthy technology adoption plan for every healthcare organization.

 
Shawn ConnellyTechnical WriterCommented:
You are correct but I can assure you that these are not as a result of disk errors. Some program is saving these files. Are you able to correlate the times/dates of these tmp files?

To be certain, however, run a full Synology diagnostic.
0
 
Gerwin Jansen, EE MVETopic Advisor Commented:
Can you run some anti-malware like MBAM on both Win7 machines? Do a quick scan first. Anything found?
0
 
Shawn ConnellyTechnical WriterCommented:
Although it never hurts to run a malware scanner, these tmp files are unlikely the result of malware.

A couple of things to look at:
- check the properties of the tmp files. You should be able to determine who created them (owner).
- how large are the files?
- occasionally, opening the files (in a program like Notepad ++) will reveal the program that created the files (if you sift through the unreadable data). But don't use Windows Notepad.
0
 
noclavAuthor Commented:
do you know where in notepad++ to find out who created these files.
0
 
Shawn ConnellyTechnical WriterCommented:
>do you know where in notepad++ to find out who created these files.

No place in particular, you just need to look carefully at the text in order to deduce the likelihood of which program created the tmp files. I'm not claiming that this is always possible but many tmp files do include clues.

How large are the files? If they are very large, this might be a near impossible task.
0
 
noclavAuthor Commented:
all TMP file sizes are under 1M i looked at the properties of one tmp file and it said the owner was Unix\1028
Computer DISKSTATION.
So this would tell me that the synology box is creating these. I ran a few virus scanners on both machines and they came up clean.
0
 
Shawn ConnellyTechnical WriterCommented:
Interesting.
Are you running any Synology or 3rd party apps? If so, which ones?
0
 
noclavAuthor Commented:
no third party apps just the default apps that came with the unit.
0
 
kode99Commented:
Go into the DSM Control Panel - > File Services on ver 5 or Win/Mac/NFS on ver 4.

On the windows file service tab or section there is a option to 'Enable Transfer Log'

Check this and apply.  This will log all windows related file activity including the IP and user etc.  This should allow you to pinpoint exactly where these files are coming from next time they turn up.

Definately look like something's temporary files.  A diskstation with no extra apps running is not going to produce these.

Only time I've seen malware produce something like this is when it renamed users files with random unique names.  If you looked at those they were still intact - just very annoying to fix.
0
 
noclavAuthor Commented:
i did already enable that earlier to see if this happens again. Here is what i found so far . If i rename the tmp file to a doc file it opens fine in word. So maybe this is a bug with word 2013.
0
 
kode99Commented:
You would likely also see that if somebody did a hard power down while stuff was open in word since it can't clean up after itself.  Or any other situation that does not programs to clean up their temp files.

Probably also see a bunch of tmp in the network recycle bin (if its in use) if word is using the network drive for tmp files (or other programs for that matter).

Definitely not a issue with the Synology unit itself.
0
 
noclavAuthor Commented:
here is an update, There is a few issues, one is that these word docs are being converted to tmp files, 2nd files are automatically being moved and removed from the recycle bin in the diskstation, 3rd i created a txt file named test.txt with jibberish and saved it to the mapped drive pointed to the diskstation, after a few min the file name changed to new text file.txt i checked the task scheduler and no tasks exist.
0
 
kode99Commented:
Check the transfer log activity and see what it says made the changes.

So you used notepad to make 'test.txt' and after a bit of time the file changed to 'new text file.txt' ?
0
 
noclavAuthor Commented:
in the log it shows that the user renamed it and i know for a fact i did not rename it. I think now this has to do with the Diskstation. Here is another thing i found. I emptied the recycle bin from the diskstation then unchecked enable recyclebin and then reenabled it. I then opened a few word docs for ex share\clients\client1\doc1.doc and doc2.doc
then i closed them and opened the recycle bin and i saw a folder named clients\client1 and was empty. Why the folder was created in the recyclebin is beyond me.
0
 
kode99Commented:
If the log shows a user it means that the user that was logged into the diskstation is the 'source' of the file activity.  It might not be done by the user personally but it means the action is initiated from the computer the user is logged into at the time .  Could be any process on the system doing it.

What version of DS are you using?

You could use Sysinternals Process Monitor on your windows system to see exactly what process is doing it.  It can be a bit overwhelming  lots of more basic file activity monitoring tools out there as well if you google it.

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx
0
 
noclavAuthor Commented:
Here is what i did to resolve this. I performed a reset on the device and re installed the DSM software updates and reconfigured the device. It has been over 3 days and so far so good.
0
 
noclavAuthor Commented:
Only solution i found to resolve this.
0

Featured Post

 The Evil-ution of Network Security Threats

What are the hacks that forever changed the security industry? To answer that question, we created an exciting new eBook that takes you on a trip through hacking history. It explores the top hacks from the 80s to 2010s, why they mattered, and how the security industry responded.

  • 9
  • 5
  • 4
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now