When BitLocker refuses to unlock an external drive, you usually see the same frustrating loop: you plug in the USB drive or external SSD, Windows prompts for the password or smart card, you enter the 48-digit recovery key or password correctly, and then you get “The password entered is incorrect,” “Access Denied,” “This drive cannot be unlocked with this key,” or the drive simply shows as “BitLocker locked” with a gold padlock in File Explorer and no option to enter a key. In Disk Management the volume may appear as RAW, Unknown, or BitLocker Encrypted but will not mount to a drive letter, and double-clicking it triggers error code 0x80070021 or 0x800710DF.
This is an urgent data-access issue, not just an annoyance. If the header or metadata is damaged, every failed unlock attempt and every forced removal can make recovery harder, especially on drives with write caching enabled. Stop trying random passwords, do not initialize or format the drive when Windows suggests it, and leave the drive connected through a rear USB port without a hub while you work through the fixes below. As of early 2026, Windows 11 23H2 and 24H2 handle external BitLocker volumes the same way, so these steps apply to both versions.
Likely Causes
| Cause | How to confirm | Fix difficulty |
|---|---|---|
| Drive letter conflict or offline disk state | Open Disk Management (diskmgmt.msc) – drive shows Online but without a letter, or Offline with a grayed icon | Easy |
| USB power, hub, or driver fault | Drive works intermittently, clicks off, or shows Code 43 / Unknown USB Device in Device Manager | Easy |
| BitLocker metadata or file system corruption from unsafe removal | manage-bde -status reports “Percentage Encrypted: Unknown” or “Lock Status: Locked” and chkdsk cannot run | Moderate |
| Wrong unlock method or mismatched recovery key | You have multiple recovery keys in your Microsoft account and the Key ID on the prompt does not match the printed key | Moderate |
| BitLocker service or Group Policy blocking external unlock | Other external BitLocker drives also fail on this PC, but unlock normally on another PC | Moderate |
| Failing sectors or enclosure failure | Drive makes clicking sounds, takes minutes to appear, or CrystalDiskInfo / SMART shows Reallocated Sectors or Current Pending Sector count rising | Hard |
Fix 1: Reassign the Drive Letter and Bring the Disk Online
What causes it
Windows assigns drive letters at mount time. If the letter previously used by your external drive is now taken by a network mapping, hidden partition, or a previous USB device, the BitLocker unlock dialog may never appear and File Explorer shows “Access Denied.” The disk can also be left in an Offline state after a power loss or Storage Spaces conflict.
How to check
Press Windows + X and select Disk Management. Look for your external drive in the lower pane by its size and label. Note whether it says Online or Offline on the left, and whether the encrypted partition on the right has a drive letter like E: or shows no letter. Press Windows + R, type cmd, and run manage-bde -status to see if the volume is listed as Locked without a drive letter.
What to do
In Disk Management, if the disk says Offline, right-click the disk number on the left and choose Online. Right-click the BitLocker partition on the right, choose Change Drive Letter and Paths, click Add or Change, and assign an unused letter such as M: or X: . Do not format. Click Cancel if Windows offers to initialize the disk. Then double-click the drive in File Explorer and enter your password or recovery key again. If the dialog still does not appear, open an elevated Command Prompt (Windows + S, type cmd, right-click Command Prompt, Run as administrator) and run manage-bde -unlock M: -RecoveryPassword YOUR-48-DIGIT-KEY replacing M: with your letter.
How to undo it
Return to Disk Management, right-click the partition, select Change Drive Letter and Paths, and click Remove to clear the manual assignment. Windows will auto-assign a letter next time. If you set the disk to Online, you can right-click the disk number and choose Offline again, though leaving it Online has no downside.
Fix 2: Bypass the USB Hub and Refresh the USB Driver
What causes it
Underpowered USB hubs, front-panel headers, long extension cables, and stale USB drivers cause brief disconnects during the handshake that BitLocker uses to verify the key. The drive may enumerate and then immediately drop, which looks like a password error even though the key is correct.
How to check
Open Device Manager (press Windows + X, select Device Manager). Expand Universal Serial Bus controllers and Disk drives. Plug the drive directly into a rear motherboard USB port – use USB Type-A 3.0 (blue insert) or USB-C directly on the case, not a hub. Watch Device Manager for a yellow warning icon, an entry called Unknown USB Device, or the external drive appearing and disappearing within seconds.
What to do
Remove all hubs, docks, and adapters and connect the drive to a rear USB port with the original short cable. If you must use a hub, use a powered hub with a 12V adapter. In Device Manager, right-click Unknown USB Device or USB Mass Storage Device and choose Uninstall device, check Attempt to remove the driver for this device if offered, then unplug the drive, wait 10 seconds, and plug it back in to reinstall the driver. Next expand Disk drives, right-click your external drive model, choose Uninstall device, and reconnect. Restart the PC and try unlocking again.
How to undo it
Reconnect your hub or dock as before. Windows will reinstall the hub driver automatically. No settings are permanently changed by uninstalling the USB device entry.
Fix 3: Verify You Are Using the Correct Recovery Key ID
What causes it
A single Microsoft account can store dozens of BitLocker recovery keys if you have encrypted multiple drives or reinstalled Windows. Entering a valid 48-digit key for a different drive or an older key after re-encryption will always return “The recovery key is incorrect” even though the format looks right.
How to check
On the locked drive prompt in File Explorer, click More options and then Enter recovery key. Note the 8-character Key ID displayed at the top, for example 3F4A9C12. On a working computer, sign in to your Microsoft account recovery key page and compare the Key ID column to the one on the screen. Also check any printout, USB text file (BitLocker Recovery Key.txt), or Active Directory location where the key may have been saved. The Key ID must match exactly before the key will work.
What to do
Copy the 48-digit recovery key that matches the Key ID on the error screen, including the dashes. In an elevated Command Prompt run manage-bde -unlock E: -RecoveryPassword 111111-222222-333333-444444-555555-666666-777777-888888 using your actual key and drive letter. Type it carefully or paste from the account page to avoid transposed digits. If your key is stored in a file, open it with Notepad from C:\Users\YourName\Documents or the USB you saved it to and copy-paste to avoid typing errors. Do not use a key with a different Key ID.
How to undo it
No system change is made. Simply close the prompt if the key was wrong. Keep all recovery keys stored; do not delete the extra keys from your Microsoft account until you have confirmed which volume each belongs to.
Fix 4: Restart BitLocker Services and Allow Unlock on This PC
What causes it
The BitLocker Drive Encryption Service can stall, and enterprise or university Group Policy or registry settings under Encryption can block passwords or recovery keys for removable drives. When this happens every external BitLocker drive fails on one PC but works on another.
How to check
Press Windows + R, type services.msc, and locate BitLocker Drive Encryption Service. Check whether Status is Running and Startup type is Manual. Press Windows + R, type gpedit.msc (Windows Pro and higher), navigate to Computer Configuration, Administrative Templates, Windows Components, BitLocker Drive Encryption, Removable Data Drives. Look at policies named Control use of BitLocker on removable drives, Allow access to BitLocker-protected removable drives, and Deny write access to drives not protected by BitLocker. If any show Enabled with restrictions, they may be blocking unlock.
What to do
In services.msc, right-click BitLocker Drive Encryption Service and choose Restart. If it is Stopped, double-click it, set Startup type to Manual, click Start, then Apply. In the elevated Command Prompt run manage-bde -unlock E: -pw to force a password prompt and test. For Group Policy, set Control use of BitLocker on removable drives to Not Configured, double-click it, select Not Configured, click Apply. Do the same for Deny write access if it was enabled. Run gpupdate /force in an elevated Command Prompt and restart. On Windows Home, check Registry Editor at HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE – if RDVAllowBDE or RDVDenyCrossOrg values exist and are set to block, back them up before changing.
How to undo it
Return services.msc BitLocker Drive Encryption Service Startup type to Manual if you changed it; it starts on demand anyway. In gpedit.msc set any policies you modified back to their previous Enabled or Not Configured state and run gpupdate /force again. Restore registry values from your export if you edited them.
Fix 5: Run the BitLocker Repair Tool on a Cloned Image
What causes it
Unsafe ejection, power failure during encryption or decryption, or bad sectors at the start of the volume can corrupt the BitLocker metadata header or the NTFS file system inside the encrypted volume. Windows then cannot validate any password or recovery key, even the correct one.
How to check
In an elevated Command Prompt run manage-bde -status E: and look for Conversion Status, Percentage Encrypted, and Protection Status. If Percentage Encrypted shows Unknown, 0.0 percent, or the command returns ERROR: An error occurred, metadata may be damaged. Run chkdsk E: /f – if it returns Cannot open volume for direct access because the volume is still locked, that is expected; do not force it.
What to do
Do not run chkdsk /f or format on the original drive while it is locked. First create a sector-by-sector clone to another drive of equal or larger size using a tool that copies hidden sectors. Then use the BitLocker Repair Tool included in Windows. Open an elevated Command Prompt and run repair-bde E: F:\RecoveredImage.img -rp YOUR-48-DIGIT-KEY -Force where E: is the locked source and F:\RecoveredImage.img is a path on a healthy NTFS drive with free space larger than the source volume. The tool decrypts the data to the image using the recovery key without repairing the original. If you have a password instead of a recovery password, use repair-bde E: F: -pw where F: is an empty formatted drive and enter the password when prompted. Let it complete to 100 percent before interrupting.
How to undo it
repair-bde does not modify the source drive when you output to an image file, so no undo is needed. Delete the recovered image file from F: if you no longer need it. Keep the original locked drive untouched until you have verified recovered files open correctly.
Fix 6: Disable Write Caching and Power Saving for the External Drive
What causes it
Windows write caching and USB selective suspend can leave the BitLocker filter driver with unsynced buffers. The drive may appear unlocked briefly then lock again, or Windows may report The device is not ready after a successful password entry.
How to check
Open Device Manager, expand Disk drives, double-click your external drive, open the Policies tab. Note whether Better performance with Enable write caching on the device is selected. Then go to Control Panel, Power Options, Change plan settings, Change advanced power settings, expand USB settings, USB selective suspend setting and see if it is Enabled for Battery and Plugged in.
What to do
In the Policies tab for the external drive, select Quick removal and click OK. This disables write caching for that device and forces immediate writes. In Power Options advanced settings, set USB selective suspend setting to Disabled for both Battery and Plugged in, click Apply. Go to Device Manager, Universal Serial Bus controllers, double-click USB Root Hub (USB 3.0) and Generic USB Hub, open Power Management tab, and uncheck Allow the computer to turn off this device to save power. Safely eject the drive with the system tray Safely Remove Hardware icon, wait for Safe To Remove Hardware notification, unplug for 15 seconds, reconnect, and retry the unlock.
How to undo it
Return the Policies tab to Better performance if you prefer, and re-enable Allow the computer to turn off this device to save power and USB selective suspend to Enabled. These are performance and power preferences and do not affect encryption.
Fix 7: Test the Drive on Another PC and Check SMART Health
What causes it
If the external enclosure electronics or the disk itself is failing, BitLocker cannot read the volume header reliably. The same key will fail everywhere on that specific hardware, while a different USB drive unlocks normally, which points to hardware rather than encryption.
How to check
Connect the drive to a second Windows 10 or 11 PC with a rear USB port and try manage-bde -unlock with the same recovery key. Listen for repetitive clicking, beeping, or spin-down sounds. On the second PC install a SMART monitor and check Reallocated Sector Count, Current Pending Sector Count, and Uncorrectable Sector Count. Any raw value above zero that is increasing indicates surface failure.
What to do
If the drive unlocks on the second PC, immediately copy critical data off before troubleshooting the first PC’s drivers or policies. If it fails on both PCs and SMART shows errors, power the drive down and do not run chkdsk /r or prolonged scans which stress failing media. If the enclosure is removable, remove the bare 2.5 inch or 3.5 inch drive from the enclosure (usually Phillips screws on the case, SATA to USB bridge inside) and connect it directly via a known-good SATA to USB adapter or desktop SATA port, then retry repair-bde to an image as in Fix 5. For mechanical clicks or no detection, contact a data recovery lab rather than opening the drive platters.
How to undo it
Reassemble the drive into its original enclosure if you removed it. No software setting is changed by testing on another PC, so reconnect to the original PC once health is verified.
If Nothing Works
If the volume still reports Locked after trying the correct Key ID and repair-bde fails with “A recovery key is required” or “The data is invalid,” the BitLocker header may be overwritten or the drive may have been reformatted. Check for backups first: search File Explorer for BitLocker Recovery Key.txt, check your Microsoft account devices page, and if the drive was on a work or school account ask the IT administrator to look in Azure Active Directory or Active Directory under BitLocker recovery. Look for shadow copies or File History on the PC that last wrote to the drive at Control Panel, System and Security, File History. If data is irreplaceable and repair-bde cannot produce a readable image, power off the drive and consult a professional recovery service that advertises BitLocker logical recovery – they can parse metadata and attempt header reconstruction from clones. Do not run diskpart clean, initialize, or format, because those write new partition tables that destroy recoverable metadata.
FAQ
Can I unlock a BitLocker external drive on a Mac or without the password?
macOS has no native BitLocker unlock. You need Windows 10 or 11 Pro, Enterprise, or Education to use manage-bde and repair-bde, or Windows Home to unlock a removable drive if you have the password or recovery key – Home can unlock but not encrypt. There is no bypass or master key; without the correct password or 48-digit recovery key the data remains encrypted by design. Third-party Mac tools that claim to unlock BitLocker are just wrappers that still require the key.
Why does BitLocker say the recovery key is correct but the drive stays locked?
This usually means the file system inside the encrypted volume is damaged, not the key. BitLocker decrypts blocks on the fly, and if NTFS structures are corrupt Windows remounts the volume as locked to prevent further writes. Use repair-bde to decrypt to a separate healthy drive or image file with the recovery key, then run chkdsk F: /f on the decrypted image, not the original, to fix file system errors.
Will reinstalling Windows or moving the drive to a new PC delete my BitLocker data?
No. BitLocker encryption is stored entirely on the external drive, not on the PC. Reinstalling Windows or connecting the drive to another Windows PC does not modify the external volume. You will still need the same password or 48-digit recovery key that matches the Key ID shown on the unlock prompt, regardless of which computer you use.
How do I avoid BitLocker external drive unlock errors in the future?
After you regain access, always use Safely Remove Hardware before unplugging and wait for the Safe To Remove Hardware toast. In BitLocker settings (Control Panel, System and Security, BitLocker Drive Encryption) click Back up your recovery key and save it to your Microsoft account and to a printed copy stored separately from the drive. Keep encryption in a healthy state – in an elevated Command Prompt run manage-bde -protectors -get E: and confirm Password and Recovery Password protectors are listed. Pause BitLocker before major BIOS or motherboard changes if the external drive is used for system backups.
