The fault · BitLocker & TPM lockouts
A machine sat at the 48-digit prompt is rarely a broken machine. When the drive was encrypted the TPM took measurements of the hardware and the boot path; something has moved since — firmware, a Secure Boot setting, a swapped board — and the chip keeps the key sealed until the 48 digits are typed in. Underneath, the disk is generally fine. Most of these come off managed work laptops around Hull — an Old Town practice, an office on Hedon Road — encrypted by policy, so they start with sign-ins rather than screwdrivers.
An engineer will take the details
0800 6890668
| The symptoms | What the fault is | What to try |
|---|---|---|
| The blue recovery screen instead of Windows | What the TPM measures no longer matches, so it keeps the key shut away | Search for the key. Do not guess at it. |
| The line telling you to use the number keys or F1-F10 | This line is only how to type the digits in | Digits only. A Windows password does nothing here. |
| Recovery key ID (to identify your key): | Eight characters that say which key this volume takes | Check that ID against every escrow |
| For more information go to: aka.ms/recoverykeyfaq | Microsoft's own page about it | Most keys turn up in an account |
| BitLocker waiting for activation | Set up on the volume, but never actually run | Nothing is encrypted. Anyone can read it. |
| A failing disk with a sealed partition on it | The hardware comes before the key hunt | Copy it locked, then open the copy |
Each item that arrives gets a case number the day it lands. An engineer looks at it and finds the real fault, and that costs you nothing. You are told in plain terms which files can come off the drive and which cannot. A price follows — one figure, written down. No work starts until you have seen it and agreed to it.
Everything hangs on the eight characters above the prompt. They name the one key this volume will open for. After that you work through a list: the Microsoft account somebody used when the machine was new, a work or college sign-in, whatever IT escrows into Entra ID or into Active Directory, and the sheet printed at the time. With no key there is no way in, for us or anyone else.
If the disk is failing, the sector copy is taken with the encryption untouched, so a worn mechanism never has to sit through a full decryption pass. That work all happens on the copy.
The image opens the moment a key is found. Where the BitLocker metadata has taken damage as well, repair-bde — Microsoft's own tool — writes the volume back out onto other media, and the files come home on storage bought for the job.
You are not billed while you are still thinking. The list of what came off the drive goes to you first, and the invoice waits on your word. Files go home on media bought in for the job, with the postage back on us. We keep the job open until you have opened them on your own machine.
Plainly put: with the 48 digits gone, the volume stays shut for good. Microsoft will tell you the same, and so will we, because encryption that a lab could get past would be worth nothing to anyone paying for it. So the first job is a search rather than a strip-down: the account at home, the account at work, whatever IT keeps in escrow, a printout tucked in the back of a folder. Find that and the files nearly always follow. And if the key exists nowhere at all, no honest firm can open the disk — you are told so at the free diagnosis rather than finding it on a bill.
Nobody at the practice had ever written the recovery key down, and one morning the workstation asked for it: an overnight firmware update had changed what the TPM measures. The Recovery Key ID was sitting in the firm's Entra ID escrow all along. That was enough. repair-bde wrote clean BitLocker metadata onto a fresh disk, and every project file came back.
Begin with the eight-character Recovery Key ID on the screen; it names the key this volume will take. A home machine has usually put it in the Microsoft account Windows was set up with: aka.ms/myrecoverykey. For a work laptop, aka.ms/aadrecoverykey, then whoever looks after Intune or AD. After that, the printed sheet in a drawer.
Yes. Microsoft has no back door and there is none here either. A volume sealed with no key to hand is encryption working exactly as sold. The cases that do come good are ones where a key survived somewhere, and the real fault turned out to be a failing disk or broken metadata.
The TPM compares the machine booting now against what it measured when the drive was first encrypted, and something no longer lines up. A BIOS update will do it on its own. So will a Secure Boot change, a swapped motherboard, or the disk being moved into a different computer. A Windows update tripped whole fleets in July 2024.
The hardware. A full sector image comes off first with the lock still on, and the key goes onto the image rather than the disk itself. Decryption has to read every sector in a single run, which is a lot to ask of a mechanism that is already struggling.
Leave it switched off. A failing drive has a limited number of starts in it, and each one spends a little more. The free diagnosis will say which files can be read.