Completely recovering from a “bricked” Buffalo LinkStation LS200-series NAS (and opening the firmware too!)

I recently bought a Buffalo LinkStation LS220 NAS (network-attached storage) device. The device itself is a good quality piece of hardware, but the software leaves a lot to be desired. I bought this NAS purely as a redundant (i.e. RAID1) backup solution and intended to use it as an SSH server for my rsync backup scripts.

Much to my disappointment, however, the firmware came far more locked-down than I had hoped, and provided no means to (easily) enable SSH. In my struggles to find an elegant solution to this, I ended up “bricking” the device, meaning it would no longer boot. To make matters worse, I later found out that the LS220’s recovery features are stored on the disks’ /boot partition, which I had wiped while cleaning down the disks.

The information available online for unbricking and/or opening the firmware of the LS200-series is… sparse. I ended up having to contact Buffalo support in order to rectify everything. Thinking they’d tell me I’d voided my warranty and couldn’t help me as such, I was pleasantly surprised at how helpful they were in providing me TFTP Boot instructions, including all the relevant software and images required.

This post should act as a definitive guide to unbricking your LS200-series. I’ve even provided instructions on how to open up the firmware, enabling SSH, Telnet and more. Note that you will lose all data on your NAS, so perform any backups where possible.

This guide assumes you are running Linux and that your NAS is a LinkStation LS220.

Part 1: Wiping the drives

  1. Open up the front plate on your LS220 and remove both hard drives.
  2. Take a Phillips-head screwdriver and remove the screws on both hard drive mounting plates, so that the drives come away.
  3. Attach the hard drives to your computer. You can do this using a USB-SATA hard drive (3.5″) dock (I bought this one)
    …or, if you have spare SATA and power cables, just connect it directly to your computer’s motherboard.
  4. Open up a terminal and run GNU Parted on the block device representing the connected hard drive. Be careful during this part, as you don’t want to wipe your computer’s primary drive.
    In my case, the NAS drive shows up as /dev/sdb so I run Parted as follows:

    $> sudo parted /dev/sdb
  5. Using the parted print command, we can see that there are six partitions on the NAS drive by default:
    (parted) print
    Number  Start   End     Size ...
    1      17.4kB  1024MB  1024MB ...
    2      1024MB  6144MB  5119MB ...
    3      6144MB  6144MB  394kB ...
    4      6144MB  6144MB  512B ...
    5      6144MB  7168MB  1024MB ...
    6      7168MB  2992GB  2985GB ...
  6. Let’s go ahead and remove all of them:
    (parted) rm 1
    (parted) rm 2
    (parted) rm 3
    (parted) rm 4
    (parted) rm 5
    (parted) rm 6
  7. Great! You can now unplug this hard drive and repeat the above process for the other drive.
  8. Once both drives are done, screw the mounting plates back on to the hard drives and install them back into the NAS.

Part 2: TFTP Boot

This step involves flashing a minimal image to the drives, allowing it to boot into EM Mode. EM Mode allows us to get our final, fully-working firmware image on to the NAS.

Unfortunately, you’ll need a Windows PC for this part. I just ran a Windows 7 VM with a network interface bridged to my host’s eth0 interface.

  1. Connect your PC directly to your NAS with an Ethernet cable.
  2. Plug in and power on your NAS. After a few seconds, the LED on the front will flash red to let you know it failed to boot anything.
  3. The NAS will assign itself an IP address of 192.168.11.150/24. You will need to set Windows to a static IP of 192.168.11.1/24 in order to serve up the TFTP Boot image.
    To do this, open up Control Panel > Network and Sharing Center and click Change adapter settings.
    Right-click your network adapter and click Properties.
    Double-click Internet Protocol Version 4 (TCP/IPv4).
    Choose Use the following IP address and set the below values:

    IP address: 192.168.11.1
    Subnet mask: 255.255.255.0
    Default gateway: (leave blank)

    Then click OK and OK again to leave the Properties screen.

  4. Download the TFTP Boot server and images from the link below. I received these from Buffalo support and am hosting them here for convenience:
    TFTP Boot Recovery LS200
  5. Unzip the downloaded file and launch the TFTP Boot.exe program. The program should tell you its “listening On: 192.168.11.1:69”. If not, you have not configured your network adapter correctly.
    The bottom line should read “accepting requests” with a flashing cursor.
  6. Press the physical Function button on the back of your NAS until the LEDs start flashing white.
    The TFTP Boot window should now output two messages like below:

    Client 192.168.11.150 ... Blocks Served
    Client 192.168.11.150 ... Blocks Served
  7. Great! At this point, your NAS will be booting a minimal image and will boot itself into EM Mode. You can close the TFTP Boot program, as we are done with it now.

Part 3: Opening up the stock firmware image (SSH, Telnet, …)

  1. Download the NAS Navigator program from the link below. This should work in Linux under Wine/Crossover:
    NAS Navigator
  2. Unzip and install the program by running NasNaviInst.exe. Now run the NAS Navigator program.
  3. After a few seconds, your NAS should show up. Note that it is in Emergency mode and has an IP address in the range 169.254.0.0/16.
  4. Repeat the instructions from Part 2, Step 3 above, but this time set an IP address of 169.254.11.1 and a subnet mask of 255.255.0.0

    Very important
    :
    Note the subnet mask’s third number is a 0 (zero) and not 255.
  5. Download and unzip the latest firmware for your device from the Buffalo website below:
    http://www.buffalotech.com/support_and_downloads/downloads
  6. Download and unzip the linkstation-mod tools from GitHub below:
    linkstation-mod 

    You can also clone the repo if you’re comfortable using Git.

  7. Open up a terminal and browse to the linkstation-mod directory. Run the open-ls-rootfs.sh script on the hddrootfs.img file as below.

    Bonus – root login to NAS:
    Add your SSH public key to the “data” directory and rename it id_rsa.key. This will automatically install the key and grant you root access to the NAS.


    Very important: If you are not the root user, you must use sudo to execute the script due to some permissions requirements making /dev files. I spent hours trying to figure out why my LinkStation wouldn’t boot as a result of running this as a regular user.

    $> chmod +x ./scripts/open-ls-rootfs.sh
    $> sudo ./scripts/open-ls-rootfs.sh /path/to/firmware-directory/hddrootfs.img
  8. After the script has completed, you will see a new directory: “out“. Inside this directory is the (hacked/opened) hddrootfs.img file.
    You will need to change the permissions on this back to your regular user. For example, if your username is “aaron”:

    $> sudo chown aaron:aaron ./out/hddrootfs.img

    Copy this new hddrootfs.img file to the firmware directory, overwriting the old version.

  9. Back in Windows (sorry), open up the firmware directory and open up the configuration file LSUpdater.ini. Add the following lines to the bottom to enable Debug Mode:
    [SpecialFlags]
    Debug = 1
  10. Run the LSUpdater.exe program. It should find your NAS. Click the window decoration in the top-left corner and click Debug(D)…Tick and untick the appropriate options until your configuration looks as below:debug_mode
  11. Click OK, then Update. You should now get a pop-up window saying “Formatting”, followed by “Transferring firmware”.

And that’s it! Your LinkStation LS200-series is now fully recovered and is now running an open firmware.

 

This entry was posted in Buffalo LinkStation LS220, Linux and tagged , , , , , , , , , , , , , , , , , , , , , , , . Bookmark the permalink.

57 Responses to Completely recovering from a “bricked” Buffalo LinkStation LS200-series NAS (and opening the firmware too!)

  1. John R says:

    Do you know if this boot image can also be used for the LS400? I cannot find that boot image anywhere.

    • Aaron Hastings says:

      Hi John. It’s unlikely and I wouldn’t chance it. I had bad luck trying to boot other images. If you contact Buffalo support, they should provide you a download link and the rest of these instructions should apply. Hope this helps.

      • John R says:

        Unfortunately, I have contacted them and they were not helpful in the least. As you did, I wiped the drives in an attempt to make repairs and apparently cleaned the images off. They suggested I try the TFTP route, but did not supply any links to LS400 boot images.

        Any ideas?

        • Aaron Hastings says:

          Hmmm… that’s frustrating. Did they give a reason for not providing you with TFTP Boot images? Did you explicitly ask for them? If not, I’d definitely open another case requesting them. I doubted they’d link me to them either, but was pleasantly surprised.

          • John R says:

            Thanks, I was able to find an image for the LS420 through a German Buffalo support site.

            I have successfully completed Parts 1 and 2, but the NAS Navigator cannot find it thereafter in Part 3. (I assume I should still be directly connected to the device with the Ethernet cable when attempting this part.) No matter what I’ve tried, the NAS Navigator never finds the device.

            • Aaron Hastings says:

              Yep, that’s correct. Did you change your IP address to something in the 169.254.0.0/16 range? I usually just go with 169.254.11.1, but it really shouldn’t matter. Also make sure your subnet mask is 255.255.0.0 (note that that’s two zeroes for the last two digits in the IP address).

              • John R says:

                Yes, I’ve made it 169.254.11.1 and also tried 169.254.0.1…subnet mask def right too…..firewall is turned off.

                • Aaron Hastings says:

                  Okay, from my personal experience of trying “the wrong TFTP Boot image”, this usually means the NAS failed to boot into EM Mode as expected. In this case, I’d definitely go back to Buffalo support and explain where you’ve gotten so far. Make sure you persist with this, because they should definitely be able to provide you with the right images.

            • Fly says:

              Hello can you pout link for downloading the TFTP image for the LS420?
              Thanks

              • Aaron Hastings says:

                Woops, apologies, I responded to this originally thinking you said LS220. Hopefully you’ll be able to get a response from the other commenter.

      • Michail says:

        A good NAS -server should just work, at least 2 years, as long guaranty is valid.
        One shouldn’t need to tweak and trick with different solutions if manufacturer support his products properly.
        Unfortunately BUFFALO isn’t that kind od manufacturer who’s covering all products equally and as such is best to avoid it. BUFFALO = trouble !!!

  2. ilkka says:

    can anyone please say what exactly is mount directory for shared directories in 220 model? it is something like /mnt/something/shared-directory-name?

    I need this because I am trying to install utelnetd by copying it to shared directory. I meshed up the ssh (it doesnot run for some reason), so I need telnet access.

    • Aaron Hastings says:

      Hi. It should be /mnt/array1/[whatever]. You can verify this by running the lsblk command.

  3. John R says:

    Thanks for your time…..here is their response when I asked for a link to the right boot image:

    Dear John,

    Thank you for contacting Buffalo Support.

    Unfortunately, we do not support TFTP imaging. You may find suggestions from user contributions in the forum.

    If you have any questions, you may also contact us 24/7 at (866)752-6210.

    Buffalo Support Email is intended for non-critical support for customers in the United States and Canada. Any replies to this response will be handled in the order it was received. If you have an urgent issue that requires immediate attention, please contact our 24×7 support center at (866)752-6210.

    Thanks,

    Ronald Parrish
    Technical Support Associate
    Buffalo Americas
    (866) 752-6210

    • Aaron Hastings says:

      Urk… seems like one of those situations where it depends on who you talk to. In my case I contacted their European (UK?) support. It’s a ticketing system where you open a case with them. Maybe you’ll have better luck with them? Can’t hurt to try anyway! Sorry I can’t be of more help.

      • John R says:

        No worries, I do appreciate your time.

        • Daniel V says:

          Were you able to get your LinkStation to work again? I own a LS420D. Upgraded both hard drives and formatted the old ones. It seems I’m able to through the device away now…

          • Aaron Hastings says:

            I’m very hopeful that there’s a way. Daniel, have you attempted contacting Buffalo support as I did for my issue? Once you have the TFTP Boot images, there should be little stopping you!

  4. cb22 says:

    did you ever get rsync to work?

    • Aaron Hastings says:

      Hey Chris. Once SSH is enabled, it’s possible to use rsync-over-SSH. This is what I was using.

  5. Rick says:

    Hi, Very interesting read.
    I was wondering if you knew if gaining Root access/Enabling SSH was only possible from EM mode?
    I was hoping to to enable SSH/Root access, but I have a fully functional LS220. If I followed the above from step 3 could I expect the same end result???
    Thanks

    • Aaron Hastings says:

      Hi Rick – thanks for the comment – glad you found it interesting. Hmmm… from my many attempts at trying to get SSH/root on the LS220, I don’t recall finding a reliable way of doing so. There’s tutorials for getting SSH/root on other Buffalo NAS systems, but I wasn’t able to get any of them working with the LS220.

      Hope that helps,
      Aaron

  6. Rick says:

    Sorry I am a little confused here,
    “This post should act as a definitive guide to unbricking your LS200-series. I’ve even provided instructions on how to open up the firmware, enabling SSH, Telnet and more. Note that you will lose all data on your NAS, so perform any backups where possible.

    This guide assumes you are running Linux and that your NAS is a LinkStation LS220.”

    That is the model I have. Well, mine is a Link Station LS220DE.

    I was just wondering if “opening” the firmware was possible from part 3 with a working unit. Meaning enabling SSH , TelNet. In the article you stated that yours was bricked. I was just curious if this had to be done from EM mode.
    Other wise I am very confused, as I thought that is what this article in part was about,unless I have read it wrong.
    Thanks for your time!!

    • Rick says:

      Sorry, I think I misunderstood you twice! I think you meant SSH with Root access??
      Basically I am having the “can’t delete files created with Transmission” issue. I could fix it in two seconds if I had root access. I am currently going through the painful process of re-adding the torrent files so i can delete via the Transmission interface! Ugh! Never had this issue with my woefully underpowered NAS-berry Pi setup!!
      Thanks again!

      • Aaron Hastings says:

        Hi Rick. Apologies for the misunderstanding. Yes, SSH with root access is what this guide enables you to do. From what I understand, enabling SSH with root is only possible with flashing a slightly customised firmware with this enabled. This is what I do in this guide. I know there are tools like ACP Commander which allow some root’ing, but I didn’t find them very reliable.

  7. Alex Lennon says:

    Lovely bit of work. Worked like a charm. Thanks!

    • Aaron Hastings says:

      Great to hear, Alex! Thanks for the comment.

      • Ricky says:

        Hi Aaron

        I have Buffalo LS-V3.0TL.
        it is flashing blue light and I am unable to to TFTB boot recovery using
        TFTP Boot Recovery 1.53 and TFTP Boot Recovery 1.60, it stuck at
        “”accepting requests.. ”
        I have already changed my network IP to 192.168.11.1
        pressed function button for 5 seconds even. but nothing is working out.

        can you help me here?

  8. Nino says:

    Thanks for the post Aaron

    Did you look at bootstrapping the device and getting ipkg on there?

    http://buffalo.nas-central.org/wiki/Ipkg_on_the_Linkstation_(for_end-users)

    I have it working but the SSL libraries are way out of date and there doesn’t seem to be a suitable toolchain to compile new versions.

    • Aaron Hastings says:

      And thank you for the comment, Nino! To answer your question, I did indeed. ipkg is nice but it was missing a lot of what I would expect from, say, a standard Linux distribution’s package repos. Still, it was nice to be able to install the GNU Coreutils!

      Ah yes, another issue. I tried to install something from source once and ran into a big mess of dependency chains. Trying to compile everything I needed on the tiny little CPU of the LS220 was… unenjoyable…

  9. Christian Wikander says:

    Tried parts of this at home this weekend. My goal is to enable rsync so that I can backup my other NAS to this one.

    Downloaded the latest firmware for my LS220D0602 NAS, modified the hddrootfs.img including adding my public key (generated using PuttyGen on a Windows PC). After updating the firmware on my LS220 it boots into EM mode. I can get it back into working order by uploading the latest firmware to it, but the modified one won’t work.

    Are there limitations to what versions of the firmware the linkstation-mod scripts will work with? Will I be able to rsync even if I don’t add my SSH public key?

    • Aaron Hastings says:

      Hi Christian. It’s been so long since I did any of this that I’m not sure if those scripts still work. I don’t think I can be much use beyond the blog post, unfortunately. I just gave up on trying to hack the LS220 into working how I needed.

      • Christian Wikander says:

        I actually solved it.
        It actually had to do with which checkboxes you checked in the debug window in LSUpdater.
        According to the documentation of linkstation-mod you need to check Update rootfs if you’ve run the open-ls-rootfs script.
        So now my LS220D is running the modified firmware and I can SSH into it. It didn’t pick up my public key though, so I still need to investigate that, but I might as well use a VPN link between my networks instead.

        • Aaron Hastings says:

          Excellent, thanks for the update, Christian! Glad to know it’s working now. I don’t remember if I ever get my SSH key to work reliably.

  10. Simon says:

    Hi Aaron
    Appreciate that its some time that you looked at this, but I am after some advice here. Purchased a 2x4TB version of this unit the other day from Amazon for a cracking price. Currently waiting for it to arrive.
    I already have a Zyxel NAS (better – quicker 1.6MHz CPU, with twice the memory) with 2x2TB WD drives in it running RAID1/mirrored. I wanted to swap out the two 4TB drives we get with the Buffalo and use these in my Zyxel.
    Then slot my orig 2TB drives in the Buffalo and use that as a RAID0/striped config and as a backup to the Zyxel.
    I also wanted to look at rooting and setting up ssh on the Buffalo, so obviously your guide above is interesting to me. I note that you say that the recovery code in on one partition of one of the disks. So I assume if I was to do this I would have to replicate the partition tables on my orig 2TB drives if possible and sync the code across? Is the OS also on the drives, or in flash?
    Do you think this is possible, and are there any other things I need to consider?
    Have to say I was a tad surprise that there was little additional support for these units when you need to look at outside the box stuff like this. I struggle to find any mention of these units on the the Buffalo NAS-Central Wiki and forum. Odd, since they are not exactly new units.
    Appreciate any help here mate.

  11. Ricky says:

    I went through all the methods available on internet but its not helping.

  12. Ricky says:

    I have Buffalo LS-V3.oTL Model

    I tried with both TFTP Boot Recovery 1.53 and TFTP Boot Recovery 1.60
    after changing my IP to 192.168.11.1
    but it stuck at
    “accepting requests”

  13. André says:

    You. I like you. Thanks for your help!

  14. Manuel says:

    Hello, I am trying to recovering from a “bricked” Buffalo LinkStation LS200-series NAS and opening the firmware too, but I had a problem that I cant still solve, the think is when I am on Part 3 step 3 and 4 I open the buffalo with wine but it can not find my device it doesnt detect the ls210, I tried to do this on windows and also linux but still cant solve the problem because it does not detect the device.

    I will be very pleasure with your help.

    Tank you very much

  15. Ruben Martinez says:

    Hi,
    Would this procedure work for a LS210D?

  16. Joel says:

    Hi, there!.. i don’t get the output after pressing the Function button:

    Client 192.168.11.150 … Blocks Served
    Client 192.168.11.150 … Blocks Served

    Any ideas on why’s that happening to me?

    Thanks!

  17. Nate Nettrouer says:

    Aaron,
    I am new to this and trying to figure out how to do Part 3 step 7. I am not sure what all I am supposed to type in the terminal window. I am not running Linux, I just have windows. Feel free to email me with any questions.

    • Aaron Hastings says:

      Hey Nate. Sorry for the delay. For some reason this comment got caught in my spam filter. You should be able to download Cygwin, which is a Bash/Linux terminal and run it from that.

  18. Camden Jaxx says:

    Aaron,

    You are a godsend! I fought forever with trying to get my new Linkstation to work correctly and finally came across your guide. Thank you so much for all of your helpful advice!

  19. FOP says:

    This might be slightly off topic but does this also apply to the LS441D 4 disk bay model of the Buffalo Linkstation? I stumbled upon this looking for some kind of “speed” to completing a “4th disk add” to an existing three disk RAID 5 setup, but considering all options offered by the Linkstation-mod repo code; particularly, running Debian instead of the stock firmware… but have scoured the web and have never gotten a definitive answer as to whether or not this has ever been successfully done with the LS441D or not.

  20. Andrea says:

    Hi,
    I’ve got Buffalo NAS LS220D bricked. I followed the procedure illustrated on this page but it does not work.
    when I use the TFTP boot I do not see the messages described in your guide:

    Client 192.168.11.150 … Blocks Served
    Client 192.168.11.150 … Blocks Served

    I see only LED start flashing white and stop.

    and I do not understand what I’m doing wrong.
    can you help me?

  21. Pingback: Buffalo LS220 – BAMP – Buffalo Apache MySQL PHP – WebIT Tech Blog

  22. Charlyarg says:

    Excellent information! I’ll keep it at hand just when I may need it. For now I’m considering my Buffalo Linkstation as a dumb (but redundant) storage system. Geez I have the old MyBookLive (single HDD) and it offers easier “hacking”, by a simple (not so) hidden url to the SSH goodies. I enabled quite a few things there. The MBL still works (fingers crossed) but I’m starting to build something that I can rely on. Additionally, for pure fun, I built a DIY miniITX box with freenas 11 .. and it finally behaves the way I want! I’ll keep it around, as I find that you cannot add apps in the LS220DE unit (just Torrent which is alright but I need at least ARIA2 too).

  23. D33 says:

    Firstly – thanks soooo much for this page and the hosting. It wasn’t enough for me on its own but without this i’d never have got started.

    For me I didn’t wipe the drives as described as my home setup is win 10/mac. I followed the guide regarding the NAS regardless and stalled at the point where the update was supposed to flash the firmware and init the disk partitions. Without a 3.5″ caddy I couldn’t flash the drives myself. A bit of research showed me that the Windows flash tool could do it if you change/add the following ini file settings:

    [Flags]
    VersionCheck = 0
    NoFormatting = 0

    [SpecialFlags]
    Debug = 1

    Hope this helps

  24. Isberg says:

    Hi Aaron,

    Must say thanks!

    My Nas had shut down improperly when updating due to power failure.
    So this tutorial was essential to get it working again.

    Used Virtual machine and linux distro to recover data and then followed your tutorial.
    Took me a couple of hours to get all the firmware etc.
    But then it worked like a charm.

    Thanks!

    Best Regards from a thankful reader.

  25. lester says:

    I’ve had a LS-CHL 1TB since around 2008 (10 years!). It started flashing red 7 times and making an unusual continuous noise.
    I opened the unit (https://www.youtube.com/watch?v=me96S89aJQE) and cleaned it from dust.
    Among the dozens of posts on the buffalotech site, the only helpful was this one: http://forums.buffalotech.com/index.php?topic=4038.0
    Following the instructions for EM boot:
    – Power the unit down (disconnect the power by pulling out the power cable, not by using the power switch (leave power button set to “on” the whole time).
    – Reboot it, if the power led is still flashing more than 75 second’s from the start, disconnect the power and retry.
    After the first “reboot” (=power up by plug in) the unit miraculously fixed itself and showed up in NAS Navigator. Then I was able to upgrade the firmware to the latest v.1.74.

  26. MJ says:

    I couldn’t get the scripts to run, but this got me very far. Thanks Aaron.

    The rest of the solution came from here:
    https://fatmin.com/2015/02/08/how-to-fix-the-buffalo-linkstation-nas-partition-not-found-error/

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.