Cause of loss · BitLocker & encrypted
When BitLocker drops into recovery mode it is working as designed: hardware or firmware shifted, so the drive wants proof of ownership — 48 digits of it. Most 'BitLocker disasters' are key-management failures behind an alarming screen. Get hold of the key and what follows is engineering.
Speak to an engineer about it
0800 6890668
| On screen | What that tells you | First step |
|---|---|---|
| BitLocker recovery — Enter the recovery key for this drive | The pre-boot prompt — your TPM will not hand the key over by itself | Locate the key, no guessing |
| Use the number keys or function keys F1–F10 (use F10 for 0). | How the 48-digit key gets typed in | Digits are wanted here, not a password |
| Recovery key ID (to identify your key): | An 8-character tag showing WHICH key applies — not the key itself | Pair that ID with the correct key |
| For more information go to: aka.ms/recoverykeyfaq | Microsoft's stock hint address | Your account holds the actual key |
| BitLocker waiting for activation | Encryption is on, protection is paused | Open, but with no protection |
| Encrypted disk that is also dying | A physical fault sits below the encryption | Clone first, then unlock |
As soon as it lands with us, your device gets its own case number. An engineer works out the fault, says what can genuinely be pulled off, then puts one fixed price in writing — no charge for diagnosis, no obligation, and no chargeable work until you approve it.
We take the Recovery Key ID from the prompt and trace it to the real 48-digit key: a Microsoft account, a work account, IT's escrow, or the printout. Without a key nobody gets the data — that is the design — so this precedes any engineering.
If the disk is dying as well, we take a complete copy first, encrypted sectors included, so that unlocking never has to work against failing hardware.
Once we have the key, the volume opens on the image; if BitLocker's own metadata is corrupt, Microsoft's repair-bde route rebuilds it onto new media.
You sign off a complete list of the recovered files first; only then does the recovery fee fall due. Everything returns on fresh media, postage paid, and the job stays open until you confirm the files open at your end.
The blunt but useful truth: a BitLocker volume with no 48-digit key cannot be opened, and that is the whole point of it — Microsoft states as much, and so do we. So the job becomes a search: personal account, work account, IT escrow, a sheet of paper. Where the key survives somewhere, the files usually follow; where it genuinely does not, no honest lab can do anything — and you'll hear that from us free of charge, not after a bill.
Overnight a firmware update altered the TPM measurements, and the machine asked for a key nobody had noted down. Its Recovery Key ID pointed to the practice's Entra ID escrow; repair-bde rebuilt the damaged BitLocker metadata onto a fresh disk, and no project file was lost.
Look in your Microsoft account at aka.ms/myrecoverykey, or a work or school account at aka.ms/aadrecoverykey; ask IT about Active Directory or Intune escrow; or find the printout or text file saved at setup — then match it against the Recovery Key ID on screen.
No. We can't, Microsoft can't, nobody can — that is exactly what the encryption is meant to do. Cases that do come back are those where the key still exists somewhere and the fault lies in the drive or its metadata.
One of the values the TPM measures shifted — a firmware or BIOS update, an altered Secure Boot setting, a board repair, the drive moved into a different machine, or a Windows update, which caught many people out in July 2024.
Imaging comes before decryption. We copy the whole encrypted disk so the unlock happens on a sound duplicate — asking a failing drive to decrypt itself is the wrong order.
Powering a damaged device up again costs you data. Start a case first; diagnosis is free whatever you decide.