Lab record · Honest limits · EDR-2025-2330
The Update Took the Sensor, the PIN Was Forgotten.
The ProBook had recognised his fingerprint for five years. An update later disabled the sensor, and the fingerprint option simply disappeared
. It left in place the PIN that was created at the time the laptop was new: I doubt I've typed it twice since
. The third guess brought on the lockout, with a VAT quarter due, and eight years of the yard's accounts behind a screen I can't get past
.
Sound familiar? Talk to us.
0800 6890668
In plain English.
There was one big difference that this case was based upon. The Windows login prompt guards the account, not the drive (take the disk out and you can read it directly, and the login window will never show up). Encryption is the opposite type of wall. BitLocker encrypts the volume itself, on a sector-by-sector basis, and without either the key or its recovery password, all data on the encrypted volume remains unreadable to everyone, this lab included. Therefore, before fear or money enters into it, one short test will determine which wall is actually stopping access to your data, and best of all, there is no cost for performing the test.
The tools this job took.
See how your case runs →| System | The part it played | Why we rate it |
|---|---|---|
| Atola Insight Forensic | Took the write-blocked image of the NVMe before the question of keys was opened | Images several drives in parallel, quickly, with write blocking and reports built in |
| PC-3000 SSD | Confirmed the NVMe itself was healthy before any decryption was attempted | Sees an SSD at controller level — a layer below anything Windows shows |
| UFS Explorer Professional Recovery | Read the open volume straight away, and the locked one once its key surfaced | Handles the harder filesystems well — APFS, ReFS, XFS, ZFS and Btrfs |
On the bench.
Copy everything first, argue about locks later
The first job once it was in-house was to take the NVMe out of the laptop and put it onto the imager, behind hardware write protection. Lockout work earns that caution twice over: should there ever be an issue as to who owns this device, or over the encryption, we would have proof that the original drive had never been written to. And on the jobs where nobody asks about such things, the careful copy has no cost at all.
Read both volume headers before quoting a penny
The headers split the job in two. C:, the Windows volume, was plain NTFS; the sign-in that had beaten him all week meant nothing to a direct read of it. D:, which held the accounts, opened with a BitLocker signature (something he had done himself, it turned out, after losing a USB stick years before), and the written quote detailed both halves before he had spent a pound.
Chase the paper trail before conceding defeat
BitLocker names the key it is looking for using an ID, which he heard us read out to him over the phone. He knew of no such key, but he recalled Windows once making him print something. That sheet had been sitting clipped in the VAT box file behind the laptop's receipt, and D: unlocked on the first attempt. Without it, that half of the job would have gone nowhere, and he would have been told as much, plainly.
How it ended.
Both halves came back home: C: read as though no lockout had ever existed, and D: was opened by a sheet which had waited five years to matter. The accounts met their VAT deadline on new media, and now the key lives in three places, none of them the laptop.
More like this in the casebook.
More from Honest limits.
Sound like your drive?
There is one direction all of these cases point toward: shut down the device, receive the complimentary diagnostic test, and then decide.