How it was lost · encrypted & BitLocker
BitLocker will show you this screen for good reason. It has detected something different (whether it was the firmware, a change in your boot settings or your motherboard), therefore it requires the 48-digit recovery key prior to allowing anyone access. In most cases, the problem isn't with the hard disk drive itself but with where the recovery key is. First track down the missing recovery key; secondly, get a quote first, over the telephone or via our online form; thirdly, post the hard disk drive to us from Exeter or drop it off at our intake laboratory in Bristol (Monday to Friday, 9am to 5:30pm, no appointment needed) and we will take care of the rest as per standard workshop practice.
Talk it over with an engineer
0800 6890668
| The error | What it usually means | Step one |
|---|---|---|
| BitLocker recovery — Enter the recovery key for this drive | Boot measurements were altered, thus the TPM is unwilling to release the key itself | Find your key; do not guess. |
| Use the number keys or function keys F1–F10 (use F10 for 0). | The screen's typing instructions for the 48 digits | A password will get you nowhere (digits only) |
| Recovery key ID (to identify your key): | Eight characters identifying your key; alone they won't unlock anything | Match that ID with its 48 digits |
| For more information go to: aka.ms/recoverykeyfaq | Standard link from the Microsoft help site | Your account holds the key itself |
| BitLocker waiting for activation | Yes, encrypted, but protection isn't armed | Accessible, but not secure |
| A failing drive underneath the encryption | The cipher is secondary to hardware issues | Before unlocking, image the drive first |
Your device will be logged under its own case number on the day it comes into our lab. The engineer who works on your device identifies the problem with it, clearly states what we think has a good chance of coming back and provides you with one fixed quote. There are no charges for this assessment; there is no obligation for you to do anything; and paid work does not begin until you authorise us to start.
It all starts with the Recovery Key ID that you see on your screen. We follow it along the possible paths: Microsoft account, work sign-in information, IT's records, the paper copy from the original setup. If we have no key then we have no data. For us, for anyone. That is how BitLocker has been designed, so the hunt comes before the tools.
Where the hardware is failing too, we first create an exact bit-for-bit duplicate of the failing drive, still encrypted, because this will be necessary for decryption to happen without having to rely on a bad drive.
Using the recovery key, we decrypt the new duplicate. Next, we rebuild corrupt BitLocker metadata with Microsoft's tool called repair-bde and place the output onto good media.
You have access to a complete list of every item recovered from your device, which you approve prior to any fees being applied. The files will be returned via new media (brand new) with the return postage paid by us, and the case remains open for as long as it takes to confirm that all the files open properly on your own machine.
The straightest possible answer, because you deserve one: a BitLocker volume will remain locked until the 48 digits are provided. This is what both Microsoft and we say (it is the entire point of the product), and this makes recovery a "search" first: your account, the company's work account, IT's escrow, or a printout in some drawer. If the key exists somewhere, your files will usually open. If the key genuinely doesn't exist, then honestly no one can assist you, and you'll know that as soon as we give you the free diagnosis, not on an invoice.
A firmware update overnight changed the TPM measurements, which caused the machine to require an unrecorded key. The key was found through its Recovery Key ID in the practice's escrow with Entra ID, and we then used repair-bde to rebuild all the broken BitLocker metadata on a new disk. All of the practice's project files were still intact and usable after this process.
For a personal Microsoft account, go to aka.ms/myrecoverykey. For a work or school account, go to aka.ms/aadrecoverykey. Check with your IT department whether Active Directory or Intune holds an escrow copy. Look through the documentation created when you set up the device and find the printout or text file related to creating your recovery key. Compare this information to the Recovery Key ID displayed on your screen.
It cannot be done: it is completely impossible for anyone (us, Microsoft, etc.) to do so, because it is working exactly as planned. That is the whole point of encrypting your files. The only time a recovery case will work is when there is some form of surviving key and the failure was in either the drive or in the drive's metadata, and not in the encryption itself.
A TPM measurement no longer matches. This can be due to a variety of reasons. A BIOS or firmware has been updated; a user changed their Secure Boot settings; a motherboard was repaired after a failure; the drive landed in another system; or there was a Windows update, as many users saw in July 2024.
We need to create an image first and then decrypt. We copy the entire disk (encrypted) and run the unlock on the good copy of the disk; putting a bad disk back into operation by having it decrypt itself gets the order backwards.
Every time a failing hardware component is powered back up, there is additional lost data. First open a case with us: the inspection (look over) is always at no cost, whichever way it goes.