A machine ordered in August turns up in November, you plug in the drive you have used for two years, and every write is refused. The drive is fine. The old Mac still writes to it.

This is the most common shape of the question right now, because a batch of new Macs started arriving on 6 November and most of them ship with macOS 27, which has been out since 14 September. So before anyone installs a driver, it is worth ten minutes establishing which problem you actually have. Four of the five checks below have nothing to do with drivers at all.

1. Confirm the volume is actually NTFS

Disk Utility will tell you, or one command will:

diskutil info /Volumes/YOUR_DISK | grep "File System Personality"

If it says ExFAT or MS-DOS FAT32, you are already writable — macOS supports both natively — and the read-only state is coming from somewhere else. If it says NTFS, continue.

Do not substitute the partition type for this. diskutil info reports both, and they can disagree: a drive can carry a partition entry labelled Windows_NTFS while the volume on it was reformatted to something else years ago. File System Personality is the one that describes the volume you are actually trying to write to.

This check matters more than it sounds. A large share of "my Mac cannot write to this drive" reports are drives that were reformatted years ago, and the fix is not a driver but finding the real cause: a full volume, a permissions problem, or a filesystem that failed to mount cleanly.

2. Check whether the volume is BitLocker-encrypted

A BitLocker volume does not mount read-only on macOS — it does not mount at all, and Disk Utility may describe it as unreadable or uninitialised. That distinction is the fastest way to tell the two problems apart:

  • mounts, but rejects writes → filesystem-level
  • does not mount, unknown format → encryption-level

Treat these as two separate requirements. A file-system driver has nothing to say about a volume that is encrypted underneath it, and buying or installing the wrong one wastes an evening.

3. Check the boring causes

Three minutes, in order:

  • Physical write protection — SD cards and some USB enclosures have a lock switch or a read-only bridge chip. If the same drive writes fine on Windows, skip this.
  • Dirty volume — macOS may mount a volume read-only when it wants a consistency check first. Two ways to see it, cheapest first: 
diskutil info /Volumes/YOUR_DISK | grep -i "Read-Only"

That returns two booleans, and they mean different things: Media Read-Only: Yes is protection at the hardware or enclosure level, while Volume Read-Only: Yes is the filesystem layer refusing writes. Alternatively, mount | grep -i ntfs lists read-only among the options in the parentheses — it is one flag inside a list, not a separate field, so do not go looking for a line that starts with it.

Running First Aid, or letting Windows finish its check, often restores write access without any third-party software.

  • Free space and ownership — a volume with 0 bytes available or with ownership enabled for another user will refuse writes for reasons that look identical from Finder.

If all three come back clean and the volume really is NTFS, you have the driver question — and only then.

4. Understand what "the driver" actually is now

There is no way to add a filesystem to macOS without putting code between the VFS layer and the storage device. Historically that code was a kernel extension: loaded into the kernel, running with kernel privileges. On Apple Silicon, installing one requires changing the machine's startup security policy to Reduced Security, and that change involves a restart — Apple's own documentation is explicit about both points, and Apple now describes kernel extensions as no longer recommended for macOS.

macOS 15.4 introduced the alternative: FSKit, described by Apple as a way to implement a file system that runs in user space. A driver built this way is delivered as an app extension, runs outside the kernel, and does not require lowering the startup security policy or rebooting to install.

That is the whole structural difference, and it explains why the question "does it need reduced security?" is more useful than "is it fast?" when you are comparing options.

5. Answer two questions, and the shortlist collapses

Do you need write access, or is copying files out enough? If reading is enough, you need nothing today — the volume already mounts, and rsync -av or a Finder copy will get the data off. Two weeks of "deciding" is cheaper than one bad installation.

Are these machines managed? If the Mac is enrolled in MDM, the startup security policy is typically set by the organisation. A policy pinned to full security — a common and defensible default — makes the kernel-extension route unavailable no matter how willing you are. On a user-space driver this question does not arise.

What the new hardware does not change

A new chip generation does not change the driver model. FSKit, kernel extensions, startup security policy and the read-only default are all properties of macOS, not of the SoC. The machine that arrived this week runs the same driver stack as the one it replaced, which is why the same answer works — and why "it worked on my old Mac" is not evidence that anything changed on the new one.

The one thing that did change is the OS version the machine ships with, and therefore which driver routes exist for it at all: the user-space route requires 15.4 or later, so it is available here, while a mixed fleet still needs a plan for older machines.

What I would avoid in week one

  • Do not reformat before you know whose data is on the drive. Reformatting solves the problem permanently and irreversibly; it is a decision about the data, not about the Mac.
  • Do not change the startup security policy on a managed machine. It is a machine-wide setting, and on a corporate Mac it may not be yours to change.
  • Do not paste a script from a forum thread. Nothing in the checks above requires one.

If you end up in the driver branch and want a concrete example of what the user-space route looks like in practice, including its stated minimum version, the vendor's stated system requirements is one place to check — and the same check is worth running on any other product before you install it.

Disclosure: I work with the team that publishes DiskBee. The checks above are ordered so that the free options come first.