Open, and logging new jobs · weekdays, 9am–5:30pm Phone is quicker: 0800 6890668
HDR Hull Data Recovery 0800 6890668 Price it up
HDR / Faults and failures / Locked out by BitLocker

The fault · BitLocker & TPM lockouts

BitLocker recovery, Hull. Nothing on the disk is broken; what has gone missing is the 48-digit key.

When a computer (or laptop) sits at the 48-digit prompt, most often it means nothing is wrong with the machine. The TPM measured both the hardware and the boot process when the hard drive was encrypted, and now that things have been changed (firmware, Secure Boot settings, switched boards) the TPM will keep the key locked until those 48 numbers are inputted. The actual data on the hard disk is probably good. These machines mostly come from offices in Hull (an Old Town practice, an office on Hedon Road), where they were encrypted as part of a corporate policy. This usually causes them to go through sign-in processes rather than being opened with a screwdriver.

Only pay if we recover your data, on most jobs Free to look at, then one fixed price Parcels come in from Beverley, Grimsby and Skegness

An engineer will take the details
0800 6890668

Putting a name to the symptom.

Nothing similar? Go to the triage →
The symptomsWhat the fault isWhat to try
Instead of seeing Windows, you get the blue recovery screenWhat the TPM measures is now different, and therefore it locks away the keyLook for the key. Never attempt to "guess" the key.
The line giving you instructions on typing your 48-digit key using the number keys or F1-F10You are only given instruction on how to enter the numbers into the box.Only numbers. Your Windows login will do nothing to help here.
Recovery key ID (to identify your key):Eight characters indicating which key is assigned to this volumeCompare the key ID to each escrow.
For more information go to: aka.ms/recoverykeyfaqMicrosoft's official page on this subject.Most keys are linked to an account.
BitLocker waiting for activationIt is set up on the volume; however, it is never actually launched.No encryption exists. Anything written onto this partition can be read by anyone.
A failing disk with a locked partitionYou have to deal with the hardware first, then start searching for the key.Copy the encrypted volume while it is still locked, and unlock the copy.
Send it to us: get a quote first, either over the telephone or via our online quote form. Then carefully package it to prevent damage in transit, insure it for its full value and post the package using a trackable service to the Leeds intake laboratory; alternatively you may drop it off there (Monday to Friday, 9am to 5:30pm, no appointment needed). For laptops, PCs, Macs and recorders, we require only the drive unit itself (storage soldered to the board is not taken on; if you're not sure which kind you have, ring us first); for RAID arrays and servers, we just need the individual disks, labelled by their respective bays; for a NAS, send the drives if you can remove them, but if not, please include the entire NAS device. A single external drive goes whole, with its cable and power adapter. We pay for return postage. If you would like an engineer to inspect the packaging prior to taping the box closed, please give us a call first. Further information is available on our sending page.

The four places the key usually is.

Your Microsoft accountSign in to aka.ms/myrecoverykey from any browser. Phone browsers will do. Often your home PC stores recovery keys in that location during initial setup of an encrypted drive, but it does not mention that anywhere.
A work or college accountUse aka.ms/aadrecoverykey if signing in with your work or college account. If using a company-issued laptop (managed), the laptop automatically gives Entra ID the recovery key.
Whoever runs ITThe recovery keys stored by company machines are sent to either Intune, or Active Directory. Provide your IT department with the Recovery Key ID and most likely, it will be matched within minutes.
A printout, a file, a stickA BitLocker Recovery Key...TXT file may have been left somewhere in a folder or a sheet may have been printed by Windows when you were encrypting. This occurs much more frequently than people anticipate.

From the box arriving to the files going back.

Jobs we have logged →
01

A case number first, then a free diagnosis Free

Every piece of gear that shows up receives a case number on the very same day it arrives. An engineer examines it and determines what is really wrong with it and there is no charge for this. We give you straight language about which files we will be able to copy from the disk and which ones we won't be able to. Then we provide you with a single price quote, in writing, based upon these findings. We don't begin working on anything until you agree to the quoted price.

The diagnosis is freeOne price, put in writingNothing to pay yet
02

The search comes first

The eight characters above the prompt identify which single key will open that particular volume. Once identified, you proceed down a list: the Microsoft account that was utilised when purchasing and setting up the machine originally, a work or school login, what your IT department has "escrowed" into Entra ID or AD, and the sheet printed when you started the encryption process. Without that key, neither we nor anyone else can get in.

The ID matched upAll escrows checked
03

Copy it with the lock on

In cases where a hard drive is failing, the sector copy is made while the encryption remains intact, so the worn mechanism does not have to go through a complete decryption of the entire drive. All decryption occurs on the copied volume.

Copied while still sealedNo more strain on the disk
04

Unlock the copy, then repair it

When a valid key is located, the image will immediately mount. In cases where the BitLocker metadata on the original volume has become damaged as well, Microsoft's own tool, repair-bde, copies the data back to another storage device (bought specifically for this task).

repair-bde on the copyCopied onto new media
05

You sign it off, then it comes back

You will not be charged while you think about this. First, you receive a list of everything that was recovered from the drive. Once you have seen the list and given us the go-ahead, the bill comes next. Files are returned to you on media purchased specifically for this job and we cover the return postage as well. Your job is kept open by us until you can view them on your personal computer.

You approve the listing firstCopied onto new mediaReturn postage at our cost

What turns up most often

  • Don't confuse the eight-character Recovery Key ID with the 48-digit Recovery Key, which is used as a "key" for the volume. If typed into the Recovery Key box individually, these eight characters will not accomplish anything. Provide them to your IT department and they may be able to match them to an existing Recovery Key.
  • What happened in July 2024? A Windows Update left entire fleets at the recovery prompt. Later that month, CrowdStrike suffered a failure which affected 8.5 million devices according to Microsoft's numbers. Clearly, many organisations learned that week that no key had ever been escrowed.
  • But broken metadata is not the end of it. The bde repair tool (repair-bde) will rebuild a damaged BitLocker volume on new media. However it cannot provide the key; this remains your responsibility.
  • Locked and failing? Make sure to copy it first. Decrypting moves each head across every single sector without stopping, and a worn drive is precisely what will fail under such conditions.

Simply stated: without the 48 digits (recovery key), the volume will never again allow access. Microsoft will confirm this for you, and so will we, since an encrypted disk whose security could be compromised by a laboratory would have absolutely no value to someone purchasing the service. Therefore, the initial task involves searching rather than disassembling: the account from home, the account from work, whatever IT stores in escrow, and/or a printed copy stored in the back of a binder. Once located, the files typically follow. However, if there is no location for the key, then no reputable organisation can unlock the disk; you will be informed so during the complimentary diagnostics rather than receiving the information on a bill.

One case from the casebook.

HU · HUL-2026-0642LOGGED ✓

A firmware update in the night, and a Skegness practice shut out of its workstation

None of the employees at the practice had ever recorded the Recovery Key, but one day the workstation requested it: a previous night's firmware update had altered what the TPM measures. The Recovery Key that matched the Recovery Key ID was available through the firm's Entra ID escrow. This was sufficient. The repair-bde command generated new, clean BitLocker metadata on a replacement disk, and all project files were restored.

100% recovered3 days after it landed

Before you box it up.

Do these first

  • Take note of the Recovery Key ID, all eight characters
  • Try "aka.ms/myrecoverykey" first, then "aka.ms/aadrecoverykey"
  • Call your IT department: a managed machine will store its recovery key within either Intune or AD.
  • Locate and retrieve either the previously saved .TXT file or the printout made during setup.

What not to do

  • Randomly entering digits
  • Reinstalling Windows to remove the recovery key prompt (the files go with it)
  • Entering the 8-character ID in the key box
  • Erasing everything on the hard drive (format) because you assume the data is already gone

Asked most weeks, answered here.

Where does the recovery key actually live?

Start by noting the 8-character Recovery Key ID displayed on screen. This tells you which key to use for decrypting this volume. On a typical home PC, this key should have been stored in the Windows setup account on Microsoft's website: aka.ms/myrecoverykey. For business PCs (laptops), it can be found at aka.ms/aadrecoverykey; and if it was created through an Intune/AD policy, find the person responsible for those policies. If all else fails, look in a drawer for the printout!

If the key is nowhere at all, is that it?

Yes. There is no backdoor with Microsoft, and certainly not with us. A locked volume without a usable key means that encryption worked perfectly as advertised. Cases where volumes recover were typically ones where a key survived somewhere, and the real fault was some other failure, such as the underlying hard drive being bad or the metadata becoming corrupted.

Why is it asking for a key all of a sudden?

There is simply a discrepancy based upon how the TPM checks whether the current machine is identical to the one from which it originally collected the measurements during initial drive encryption. Either a BIOS update caused the issue, or changes made to Secure Boot, swapping motherboards or moving the disk to another machine. A Windows update made in July 2024 triggered the issue across whole fleets of machines.

It is locked and the disk is failing. What comes first?

Hardware issues. An encrypted full sector image is obtained prior to attempting decryption, and therefore the encryption key is applied to the image instead of directly to the physical disk. Decrypting requires reading each sector sequentially, which is a very large amount of data to process for a mechanism that may already be experiencing difficulties.

What people read after this.

Laptops and PCs → Solid-state drives → Not seen by the PC → Everything we take in →

A drive left switched off loses nothing more.

Leave it off. There are only a few start attempts left in your failing drive and each attempt uses up a little more of what remains. Our complimentary diagnosis will determine what files are readable.

0800 6890668

Have it looked at How to post it to us