You may sometimes find that files are unexpectedly moved, modified, or deleted. This article lists the common causes and provides methods to recover your files.

• Identify possible causes
• Restore your data
• Take preventive actions

Identify possible causes

To determine the root cause of unexpected file changes, consider the following possibilities:

• Changes made via file protocols: Users with appropriate access permissions can modify files on DSM via file protocols such as SMB, AFP, FTP, and WebDAV. If you have enabled file transfer logs for the using protocol in advance, you can observe file transfer logs to track and review these changes.
• Changes made via Synology synchronization services: Synchronization via Cloud Sync, Cloud Station ShareSync, Synology Drive ShareSync, and Shared Folder Sync can result in file changes on DSM. If you are using any of the above services, check the recent history of changes or logs to see which user modified your files.
• Changes caused by restore tasks: Files restored from backups may overwrite original files. To verify if changes occurred during file restore tasks, check the logs in packages such as Snapshot Replication, Hyper Backup, or Active Backup for Business. Then, compare the restore time with the last modified time of the files to determine if any changes occurred during restoration.
• Files quarantined by antivirus software: If you have configured a scan task in Antivirus Essential or Antivirus by McAfee, check if files have been moved to the Quarantine section. You can refer to this article to manage the quarantined files.

Restore your data

To restore your data, perform one of the following options based on the identified cause:

• If you have enabled Recycle Bin for your shared folder, go to File Station to retrieve files in a subfolder named "#recycle".
• If you have backed up your data with Hyper Backup or Snapshot Replication, restore files from your backups.
• If you have enabled version control, recover files or folders from previous versions on Synology Drive or Cloud Station.
• If the hard drives of your Synology NAS are running ext4 and no new data has been written into the NAS, you can use PhotoRec, a free third-party software, to recover lost files.

Take preventive actions

To proactively prevent unexpected file changes and ensure data integrity, consider the following measures:

• Enable file transfer logs for all the protocols you are using to identify any suspicious or unauthorized file modifications.
• Install Synology Drive Server on your Synology NAS. Go to Main Menu > Synology Drive Admin Console > Team Folder to enable the commonly used shared folder as a team folder and select Enable version control to keep at least eight versions.
• Enable Recycle Bin for your shared folders.
• Back up your Synology NAS regularly.