Job log · Where the limit falls · NTG-2025-1480
The Reader Stopped Recognising Her Thumb.
Four wrong tries had shut her out of the machine, on completion day, with clients waiting at a practice in Melton Mowbray and eight years of other people's business
sitting on the drive. Since the day she set the ProBook up, her thumb had done the work. Then an update withdrew the option — the fingerprint box has gone from the sign-in screen
— and left her with a PIN picked one afternoon eight years ago and not typed since. The reader took over on day two and I never thought about it again.
Yours doing the same? Say what it is up to — looking is free.
0115 8220606
What went wrong, and why.
Establishing which of the two you face takes about five minutes and costs nothing, so it happens before anything else: the module comes out and goes on bench hardware. If it is the first, that is an afternoon's work. If it is the second, it is a wall — and the wall is in front of this lab as squarely as it is in front of you. An account password is the easy version. What it fences off is a Windows account, and nothing under one; the sectors themselves were never told of it; and so the sign-in screen that had blocked her for a week became irrelevant as soon as the flash was addressed on its own terms. The hard version is BitLocker, which encrypts a volume from its first sector to its last. Without the key, or a recovery password acting for the key, everything lifted off those chips is noise.
The bench work this one took.
How the work runs →| Kit on the bench | What it did on this job | Why we reach for it |
|---|---|---|
| Atola Insight Forensic | Took a clone behind a hardware write blocker, and no key was discussed before that was done | Multiple images in parallel behind a write blocker, every action logged |
| PC-3000 SSD | Showed the flash to be sound in itself: encryption was the obstacle, not the hardware | Puts the questions to the controller directly, instead of believing what an operating system says |
| UFS Explorer Professional Recovery | One volume mounted immediately. The other stood still until a key turned up for it | Reads APFS, ReFS, XFS, ZFS and Btrfs where other tools give up |
What happened on the bench.
Image it before the lock is even discussed
First move on that ProBook: the NVMe came out and went behind a hardware write blocker to be cloned. The original was untouched from that point on. Two things come of working that way. If anyone later queries who owns the machine, or asks what happened to it here, the module itself can be put on the table in the condition it came in. And when the question never arises, nothing has been spent on the precaution.
Read the headers before quoting a price
A minute with the headers gave the answer. Volume one carried the operating system on plain NTFS and came off the clone without argument, which made a week behind a sign-in screen count for precisely nothing. Over the second, holding the client files, sat a BitLocker signature. Encryption had been switched on some years earlier because a checklist from her professional body told her to, and it had not crossed her mind since. Her written quotation put a price against both volumes.
Ask about the printed key before conceding anything at all
BitLocker will tell you which key it wants, so we read the identifier down the phone to her. She was quite certain nothing of the kind had ever been sent to her. Then she remembered a page Windows had once insisted she print, whose purpose had meant nothing to her at the time. She found it in a ring binder at home, behind her practising certificate, and read the identifier back. The volume opened. Had that page gone in the bin, the answer would have been no, and she would have been given it in those words.
What was returned.
She took both volumes home. The system side gave no hint that a lock had ever stood over it, and what opened the client files was one printed sheet, years old and never once read. Completions went out on fresh media, forty-eight hours later than they should have done. That recovery key sits in three separate places now, and not one of them is the laptop.
Start here if the same thing is happening to yours.
Jobs that ended in a no.
Sounds like yours? Switch it off before anything else.
£250 + VAT covers a card or a USB stick; a single drive is £300 + VAT; RAID and NAS start from £500 + VAT. Nothing is charged for the first look, and a fixed figure reaches you in writing before any chargeable work begins. Switch the device off, leave it alone, and post it in. On most jobs, no data back means no fee.