NDR / By what it is doing / The BitLocker key has gone

The fault · BitLocker, the TPM and a key nobody kept

BitLocker recovery in Nottingham. The disk is not the problem; the 48 digits are, and they are usually filed.

A machine parked at the 48-digit prompt in Nottingham is, nine times in ten, a machine with nothing wrong with it. Switching encryption on had the TPM take a fingerprint of the board and the boot path; alter any part of that — a firmware update, a Secure Boot toggle, a mainboard swap — and the chip declines to release what it holds until somebody types the digits. Which makes this a job about sign-ins, not screwdrivers. Managed work laptops make up most of it: a consultant's machine out of Worksop, an office PC from a Loughborough warehouse, a workstation off a Leicester lab bench. One drive is £300 + VAT, the assessment that comes first costs nothing, and most jobs carry no fee unless the data comes back.

No files back, no bill — on most jobs Free diagnosis first, then a single price, in writing Parcels come in from Derby, Lincoln and Loughborough

Ask an engineer, and the first look is free
0115 8220606

What the symptom points to.

Not yours? Open the fault finder →

What it looks like	What usually causes it	What that means for you
A blue BitLocker screen where Windows ought to be	What the TPM measured has changed, so it holds the key back	Go and find the key. Guessing achieves nothing.
The line about number keys and F1-F10	Keyboard advice, and nothing more than that	Digits only. Your Windows password is no use here.
Recovery key ID (to identify your key):	Eight characters naming the single key this volume accepts	Carry that ID round every escrow in turn
BitLocker waiting for activation	The volume is encrypted, but its key is stored on the disk unprotected — what Microsoft calls a clear key	Nothing guards that key, so the volume opens as it always did.
A sealed volume sitting on a disk that is failing	Hardware first, with the key search running alongside	Image it locked, then unlock the image

How to pack and post it: wedge it so it cannot move, insure the parcel for what the files are worth rather than what the drive cost, and use a tracked service to the intake lab. The journey back is on us. Would you rather an engineer went through the packing with you before the tape goes on? Ring us. It is all set out on the packing and postage guide.

Four places the BitLocker key is usually filed.

The Microsoft account at homeAny browser will do, a phone included: aka.ms/myrecoverykey. Setting up a home PC quietly escrows the key against that account, and Windows never mentions it again.

A work or college sign-inaka.ms/aadrecoverykey, using the log-in your employer or college gave you. Managed laptops push their keys into Entra ID by themselves, unasked.

The people who run your ITOn a company machine the key goes into Intune or Active Directory. Pass the Key ID to whoever administers it and the lookup is usually a two-minute job.

On paper, in a text file, on a stickA BitLockerRecoveryKey…TXT sitting in a folder nobody ever opens, or the page Windows pushed you to print while encryption was running. Both surface more often than people expect.

From the parcel arriving to the files going home.

Jobs already finished →

Booked in the day it arrives, and the first look is on us Free

Your device picks up a case number the day it arrives, and an engineer then establishes what has genuinely gone wrong — at no cost, and ahead of everything else. Two things come back to you together: a plain account of what can be lifted and what cannot, and one fixed figure in writing. Agree to that figure, or turn it down and pay nothing.

The first look is freeOne fixed figure, in writingNo charge at this point

The key search comes before anything else

One key fits this volume and the characters on screen identify it, which turns the search into a short list rather than a hunt. Was a copy printed when encryption went on? Which Microsoft account did the PC first sign into? Is there a work or college log-in? Has any IT team ever enrolled the machine into Entra ID or Active Directory? All four get tried in turn. Where the answer everywhere is no, this lab is as shut out as you are — and you are told so while the assessment is still free.

The eight-character Key ID notedEvery escrow tried in turn

Imaged with the lock still in place

A failing disk changes the running order and nothing else. The copy is taken with the volume still locked, sparing the mechanism a decryption pass it would very likely not finish, and everything after that happens on the copy.

Imaged while still lockedThe disk is not asked for more

Open the image, then mend it

As soon as a key surfaces, the copy is opened. Should BitLocker's own metadata have taken damage too, repair-bde — a Microsoft utility, not a third-party guess — reconstructs the volume onto media bought in for the job. With the metadata corrupt it needs a backup key package as well as the recovery key, and that package is only to hand where it was backed up, which in practice means Entra ID or Active Directory. What it rebuilds is what travels back to you.

repair-bde applied to the imageNew media, bought in for your job

The file list comes before the bill

The file list reaches you before any invoice does. Say yes and it is billed; say no and it is not — and on most jobs, if nothing comes back there is nothing to pay. Whatever comes off goes home on media bought in for your case, carriage at our end. Nothing here is closed until you have opened those files on your own machine.

Nothing is charged until you agree the figureNew media, bought in for your jobWe pay to send it home

What comes in most often

The ID is not the key — eight characters pointing at the 48-digit string, which is why the box turns them down however carefully you type them. Hand that reference to whoever administers your IT and the lookup is usually minutes' work.
July 2024 is the worked example — a Windows update on 9 July pushed whole fleets to the prompt, and ten days afterwards, on 19 July, the CrowdStrike outage reached 8.5 million machines running Windows, on Microsoft's own published count. A great many firms discovered that month that no key had ever been escrowed anywhere.
Broken metadata is not always a dead end — where the BitLocker structures themselves are damaged, repair-bde will write the volume back out onto other media, but only given a backup key package as well as the recovery key, and that package is only to hand where it was backed up, in practice into Entra ID or Active Directory. What it cannot do is invent either one, and that part stays yours to find.
Failing and sealed? Copy before you unlock — decryption asks for one continuous pass over the whole surface, and a drive already struggling is exactly the one that stops part-way through it.

Put plainly: no 48 digits, no volume. Microsoft says so and so do we, for the obvious reason — a lock any workshop could pick would not have been worth buying. So the bench begins with a search instead of a teardown: the home account, the work account, whatever IT escrowed, and the printout somebody filed in a binder. Turn one up and the files nearly always follow. Turn none up and no honest lab in the country is getting into that disk. You hear that during the free assessment, not on an invoice a fortnight later.

One of these, from start to finish.

NG · NTG-2026-1792ON THE LOG ✓

An overnight update, and a Mansfield practice locked out of its own workstation

Nobody at the practice realised they already held the key. An overnight update altered what the TPM measures, and the workstation came up asking for 48 digits that had never been written down anywhere. On screen was a Recovery Key ID; it matched an escrow record sitting in the firm's own Entra ID, and that answered the whole job. Fresh BitLocker metadata went onto a new disk with repair-bde, and every project file opened exactly as it always had.

100% of the files back3 days between arrival and return

What helps, and what does damage.

Worth doing first

Note the Key ID exactly, all eight characters
Sign in at aka.ms/myrecoverykey, then aka.ms/aadrecoverykey
Ask your IT team — Intune and AD hold keys for managed machines
Look through the drawer for the printout, or the saved .TXT

What makes it harder

Guessing what the digits are
Reinstalling Windows to stop the prompt — the files go with it
Entering those eight ID characters in the key box
Formatting it because you assume the data has gone

Answers before you spend anything.

Where is that recovery key likely to be?

Four places, and you can narrow it to one key before you begin: the Recovery Key ID above the prompt, eight characters long, belongs to that volume and no other. Home machines escrow against whichever Microsoft account first set the PC up — aka.ms/myrecoverykey. Company laptops escrow into Entra ID, so try aka.ms/aadrecoverykey, then whoever administers Intune or AD. Failing all three, the sheet printed when encryption was turned on.

Nobody saved a key anywhere. Is that it?

Yes, and it is the product working exactly as designed. Microsoft has no way past it and this lab has none either, so a sealed volume whose key nobody kept stays sealed. The jobs that end well are the opposite kind: somebody did keep it, and the real fault turns out to be tired hardware or metadata needing a rebuild.

Why has the key been demanded now?

Because the measurement taken at boot no longer agrees with the one recorded when the volume was encrypted. Firmware updates set it off on their own. So does a changed Secure Boot setting, a fitted mainboard, or the disk being lifted into another machine. July 2024 is the month everyone remembers, when one Windows update did it to entire fleets at once.

The disk is failing and the volume is sealed. What order?

Hardware, then keys. We copy the disk while it is still locked and apply the key to that copy, never to your original. Decrypting in place asks for one unbroken pass over the whole surface, and a worn mechanism is the least likely thing in this building to see it through.

Start here if the same thing is happening to yours.

Windows laptops and PCs → Chip-level SSD and NVMe work → The disk is not detected → The full device list →

Switched off, a drive cannot get any worse.

The look costs nothing. What comes back to you is a file list — what opened, what did not — plus one figure to finish the job, in writing, before anything chargeable begins. Most jobs carry no fee at all unless the data comes back. Leave the drive switched off until you have that list.

0115 8220606

Send it for a free look Posting it to Manchester

Disks, cards and whole machines

Start with what it is doing

Footage, forensics and reports

The price, and what happens next