Data Recovery Case File · Desktop Externals & Aging Drives · Access Denied

The wall that isn't broken: why "Access Denied" travels with the drive from computer to computer, what NTFS permissions actually are, and the photos and videos extracted past a refusal that was never about damage

Her enquiry was brief and the symptom precise: a Toshiba external drive, and "since a few days, every time I plug it in, an Access Denied message pops up. Tried from a different computer — still the same issue." Her ask: "can you help me unlock or retrieve the data inside — mainly photos and videos?" The word to notice is the one the machine chose. Not "you need to format this drive." Not "the file system is not recognised." Denied — a refusal, not a malfunction report. This archive spends most of its pages on broken structures; this one belongs to a rarer and widely misunderstood family: the permissions wall — a drive whose contents are intact and organised, guarded by ownership records that no longer match anyone asking. Where those records live, why they travel with the drive to every computer she tried, what "a few days ago" probably changed, and the professional route that reads past the paperwork entirely — all decoded below.

The decode: where permissions live, why they travel, and what changed "a few days ago"

What Access Denied actually is: drives formatted with NTFS — the standard for externals prepared on Windows — carry, alongside every folder and file, access-control records: metadata declaring which user accounts may open what. Those records don't live on the computer; they live on the drive itself, written into the filesystem next to the data they guard. Which decodes her cross-machine test perfectly: plugging the drive into a different computer doesn't reset the guardianship — the paperwork travels with the drive, and every machine she tries reads the same records and reaches the same verdict. Crucially, "Access Denied" is the filesystem working: structures parsed, folders found, rules enforced. It is a locked door in a sound wall — the near-opposite of the format prompts and RAW volumes that fill this archive's corruption pages.

Why a drive that worked for years suddenly denies its owner: permissions don't guard names; they guard account identities — the long internal identifiers behind every Windows user. A drive's files owned by "the account that wrote them" become unopenable when the asking account no longer matches: a new computer, a reinstalled Windows, a repaired or replaced user profile, a system update that rebuilt the account — any of these gives the owner a fresh identity the drive's paperwork has never met. "Since a few days" almost always has a companion event in that family, noticed or not. Sometimes, too, a partial filesystem fault presents as denial — damaged security metadata making Windows refuse rather than warn — which is why the professional route confirms structure health rather than assuming it. Either way, one thing the popup does not mean: that the photos and videos are damaged, encrypted, or gone. They are filed, named, and guarded — by records that have simply outlived their audience.

Why the fix isn't fought on the original: the internet's standard remedy — "take ownership" of everything, forcing new permissions across the drive — works often enough to be famous and is still the wrong first move on a drive that matters: it writes, extensively, to metadata across the whole volume, on a device whose underlying health is unverified, and if anything deeper is wrong, those thousands of little writes land on exactly the structures a recovery needs. The professional route inverts it: the drive is imaged write-blocked — its paperwork left untouched forever — and the extraction happens on the copy with tooling that reads past access-control lists by design: the guardianship acknowledged, and simply not asked. Her word "unlock" gets its honest translation: nothing needs unlocking; the contents need reading by something the paperwork doesn't apply to.

On the bench

The drive was imaged write-blocked behind the DeepSpar USB Stabilizer 10Gb — not one ownership record altered on the original — and the image told the fuller story: filesystem structures healthy, folders and filenames intact, the denial confirmed as pure guardianship over sound contents. OSForensics then did what it exists for in exactly this family of case: the volume read past its NTFS access-control lists, every guarded folder opened without a single permission rewritten, and her photographs and videos extracted with names, dates and folder order preserved. The set was verified by opening and playback and delivered on fresh media, formatted plainly and owned by no one's ghost — the wall left standing on the old drive, with nothing behind it anymore that she needs.

The outcome

The photos and videos extracted past the permissions wall, verified and delivered — the original drive's records untouched. Free assessment, one fixed written figure including VAT, no recovery, no fee. The refusal, decoded for every owner it stonewalls: Access Denied is a working filesystem enforcing ownership records that live on the drive and travel with it — which is why every computer agrees; the usual trigger is an identity change on your side — a new machine, a rebuilt profile — not damage on the drive's; and the safe route reads past the paperwork on a write-blocked image rather than forcing new ownership across an unverified volume. A locked door in a sound wall is the best problem in this archive to have. It just needs someone the door doesn't apply to.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.