A student’s WD Elements portable drive was seen by Windows but would not open. Access denied. Folders showed empty; changing permissions did nothing. Two years of A-level coursework were on it, and the deadline was close. The obvious fear was encryption. The truth was more mundane, and far better news — but only if nobody forced it.
A student’s WD Elements external drive was detected by Windows but refused to open: access denied. Some folders appeared empty, others would not open at all, and every attempt to change permissions through Windows Security failed. On it sat two years of A-level coursework, essays and revision notes.
Two very different things produce that message, and telling them apart is the whole job. The first is NTFS permissions — the access control list that says which accounts may read a file. Rebuild a machine, change a user, or corrupt the metadata, and Windows will happily refuse to show you your own files even though every byte is sitting there intact. The second is encryption, where the data really is unreadable without a key. They look identical from the outside. They could not be more different underneath.
The drive was write-blocked and imaged in full before anything else, and this is the part that matters most: when people meet ‘access denied’, the standard internet advice is to force a permissions change or take ownership of the drive. That writes to the drive. If the underlying file system is damaged — and here it was — forcing changes onto it can turn a straightforward recovery into a genuinely difficult one.
So the permissions work was done on the image. The file system was examined directly, the damaged access control entries rebuilt and ownership reassigned within the copy, and the directory metadata repaired where it had become inconsistent. The original drive was never modified in any way. Whether the drive was encrypted was the first thing to settle, because it decides everything else. Scanning the image with Passware Kit — the decryption suite we run, which searches a drive for keys where any exist — turned up nothing, and the volume structure showed no encryption layer. The data itself was unencrypted: the lock was administrative, not cryptographic. That is the best possible answer to that question — had it come back the other way, and had no key been recoverable from the disk, the honest conversation would have been a very different one.
Everything came back: the coursework, the essays, the revision notes, the presentations and spreadsheets, with folder structure and filenames preserved because the file system was repaired rather than carved. It went back on fresh media, verified, in time for the deadline that had made it urgent.
Forcing ownership, running chkdsk, or letting Windows “repair” a drive it cannot read are the three most common ways this job gets harder. All of them write to a drive whose file system is already damaged.
And if the drive turns out to be genuinely encrypted rather than merely locked, that is a different conversation — see BitLocker recovery, where we are equally blunt about what is and is not possible. Either way, the free diagnostic establishes which of the two you are facing before anybody touches anything.