Anyone who’s heard me teach or speak about breach data, info stealer logs, etc., knows that I actively monitor a lot of different places and gather up and store terabytes of information. Recently, I wanted to upgrade the method I was using to store this information and to make it easier to expand in the future.
I used Deep Research from OpenAI to ask a lot of questions and figure out a good strategy. What I personally settled on was a Synology DS923 Plus. I had an older Synology that was still working, but this one has much better specs for processor and memory, along with significant expansion capability.
The Hardware Setup
The DS923 Plus comes with 4 drive bays out of the box, but I can add another 5 bays with an expansion unit that Synology sells. Also, on the bottom of this NAS, there are two spots for SSD drives (they have to be NVMe, so unfortunately I can’t use an old one-terabyte SSD that I have because it’s SATA).
By putting at least one NVMe drive in there, it will cache the data that I search most frequently. So for me, when I’m using something like qGrep to create indexes and search through data, it can store that index on the SSD for much quicker lookups. This should provide a combination of both massive storage and still responsive performance when I’m searching through terabytes of information.
Factory Refurbished Drives: A Surprise Finding
As for the drives themselves, this one kind of shocked me. I went to Amazon looking for large format hard drives (I currently have 18TB and 24TB drives), and some of the results I started to get back were factory refurbished. My first thought was, “That seems crazy for a hard drive!” All hard drives eventually fail—it’s just a matter of when—so getting something factory refurbished seemed risky.
I decided to ask Deep Research this question. It spent some time researching and actually came back saying that factory refurbished drives are usually fine, and often they’re basically brand new anyway. Many times, someone bought the wrong size, got more than they needed, or something similar, and then ended up sending them back. The drives are still verified to meet specs by the factory before being released, so usually the quality is very similar if not just as good.
The one downside is typically a shorter warranty—usually 1 year instead of 2 years. But one seller on Amazon that had factory refurbished drives was offering a five-year warranty, so I thought, “Why not?” I got several 12TB factory refurbished hard drives, and they were all very cheap—around $150 each, which for 12 terabytes is kind of crazy.
The RAID Configuration
That’s the current setup I have right now. I’m copying stuff over as we speak, and so far I’m very happy with it because it’s quick, responsive, and powerful. At any time in the future when I want to upgrade, it’s not a matter of having to refactor everything—I just purchase that expansion unit and add 5 more drives.
The nice thing is that by using Synology’s own version of RAID 5 (SHR) instead of pure RAID 5, I avoid a common limitation. With pure RAID 5, all disks need to be the same size; otherwise, you’re wasting extra space if you buy bigger disks. But by using Synology’s version, when I add those five bays in the future, I can put in 24TB drives (or however big I want) and won’t be wasting space. The system will compensate and use virtually all the space available, with me only losing one drive capacity in exchange for redundancy.
These are just some of the decisions that I made, and I thought I would share them here in case anyone else was thinking about purchasing a NAS for similar purposes. If you have any experiences with anything like this, I’d love to hear from you!
