How it was lost · encrypted & BitLocker
BitLocker throws that screen up on purpose. Something it measures changed — firmware, boot settings, the board — so it now insists on the 48-digit recovery key before letting anyone in. In most cases the drama is a mislaid key rather than a broken drive. Track the key down, post the drive from Exeter, and the rest is workshop engineering.
Talk it over with an engineer
0800 6890668
| The error | What it usually means | Step one |
|---|---|---|
| BitLocker recovery — Enter the recovery key for this drive | Boot measurements changed, so the TPM refuses to release the key itself | Find the key — don't guess it |
| Use the number keys or function keys F1–F10 (use F10 for 0). | The screen's own typing instructions for the 48 digits | Digits only — a password gets you nowhere |
| Recovery key ID (to identify your key): | Just eight characters naming the right key; alone they unlock nothing | Match that ID to its 48 digits |
| For more information go to: aka.ms/recoverykeyfaq | The standard Microsoft help link | Your account holds the key itself |
| BitLocker waiting for activation | Encrypted, yes, but protection isn't armed | Accessible — just not protected |
| A failing drive underneath the encryption | Hardware trouble first, cipher second | Image it before any unlock |
Your device is logged under its own case number the day it arrives. An engineer finds the fault, tells you plainly what stands a real chance of coming back, and writes you one fixed quote. Nothing is charged for that look, nothing obliges you, and paid work starts only when you say so.
Everything begins with the Recovery Key ID on your screen. We chase it through the likely homes — Microsoft account, work sign-in, IT's records, the paper copy from setup. No key means no data, for us or for anyone; BitLocker was built that way. So the hunt comes before the tools.
Where the hardware is failing too, a sector-by-sector clone comes first — still encrypted — so that no unlock ever has to lean on a sick drive.
With the key in hand, the image unlocks. Corrupt BitLocker metadata gets rebuilt using Microsoft's repair-bde tool, with the output landing on fresh media.
Before any fee falls due you see a full listing of everything recovered and approve it. Your files travel back on brand-new media, return postage on us, and the case stays open until you've confirmed everything opens on your own machine.
Straight answer, because you deserve one: without the 48 digits, a BitLocker volume stays shut. Microsoft says so; so do we — it's the entire point of the product. That turns recovery into a search first: your account, the work account, IT's escrow, a printout in a drawer. If the key exists anywhere, your files usually come home. If it genuinely doesn't, nobody honest can help — and you'll hear that at the free diagnosis stage, not on an invoice.
A firmware update overnight shifted the TPM measurements, so the machine demanded a key nobody had recorded. The practice's escrow in Entra ID held the key, found through its Recovery Key ID; on a new disk, repair-bde rebuilt the broken BitLocker metadata and every project file survived.
Check aka.ms/myrecoverykey for a personal Microsoft account, or aka.ms/aadrecoverykey for work or school; ask IT whether Active Directory or Intune holds an escrow copy; or dig out the printout or text file made at setup. Match it to the Recovery Key ID shown on your screen.
Nobody can — not us, not Microsoft, not anyone; working as designed, that is the whole point of the encryption. The recoverable cases are the ones where a key survives somewhere and the real fault is in the drive or its metadata rather than the encryption.
A TPM measurement no longer matched: a BIOS or firmware update, a change to Secure Boot, a motherboard repair, the drive landing in another machine — or a Windows update, as plenty discovered in July 2024.
Imaging comes first, decryption second. The whole encrypted disk is copied and the unlock runs on that healthy duplicate — making a failing drive decrypt itself gets the order backwards.
Each power-up of a failing device takes more data with it. Open a case first — the look-over is free whichever way it goes.