Open, and looking at it costs nothing · 9am–5:30pm, Mon to Fri Ring instead, it is quicker: 0115 8220606
NDR Nottingham Data Recovery 0115 8220606 Get my quote
NDR / By what it is doing / The BitLocker key has gone

The fault · BitLocker, the TPM and a key nobody kept

BitLocker recovery in Nottingham. The disk is not the problem; the 48 digits are, and they are usually filed.

Most of the systems that present the 48-digit input screen in Nottingham are actually fine. The TPM captures a fingerprint of the motherboard and the boot sequence when you turn the encryption on. Any time something tied to those fingerprints changes (a firmware update, toggling Secure Boot, swapping the motherboard), the TPM refuses to hand over its contents unless someone enters the numbers by hand. So most of this is simply about logging in rather than getting the screwdrivers out. These are mainly managed work laptops: a consultant's laptop out of Worksop, an office computer out of a warehouse in Loughborough, a lab workstation out of Leicester. One drive is £300 + VAT, the first assessment costs nothing, and in most cases you only pay if we recover your data.

Only pay if we recover your data, on most jobs Free diagnosis first, then a single price, in writing Parcels come in from Derby, Lincoln and Loughborough

Ask an engineer and the first look is free
0115 8220606

What the symptom points to.

Not yours? Open the fault finder →
What it looks likeWhat usually causes itWhat that means for you
A blue BitLocker screen where Windows ought to beWhat the TPM measured has changed, so now it holds the key backGo and find the key. Guessing achieves nothing.
The line about number keys and F1-F10Keyboard advice, and nothing more than thatDigits only. Your Windows password is no use here.
Recovery key ID (to identify your key):Eight characters naming the single key this volume acceptsCarry that ID round every escrow in turn
BitLocker waiting for activationAlthough the volume is encrypted, the key sits on the same disk unprotected (Microsoft calls this a clear key)Since there is no protection for the key, the volume unlocks just like it normally does.
A sealed volume sitting on a failing diskHardware first, with the key search running alongsideImage it locked, then unlock the image
How to pack and post it: ring 0115 8220606 first, or use our online form, to get a quote. Hold the item securely, make sure the insurance covers the value of what is inside, and select a tracked delivery option to Manchester, where the intake lab receives the parcel. Return postage is covered by us. Would you like help from one of our engineers with wrapping it before you tape the package? Call us. Find all the details in our packing and postage guide.

Four places the BitLocker key is usually filed.

The Microsoft account at homeYou can use virtually any web browser (phones included) for this: aka.ms/myrecoverykey. Setting up a home PC creates a backup of the key against that account, and Windows does not mention it after that.
A work or college sign-inUsing the login provided by your employer or college, go to aka.ms/aadrecoverykey. In the case of managed laptops, keys are stored in Entra ID automatically, without prompting the user.
The people who run your ITOn a company machine, the keys go directly to either Intune or Active Directory. Give the administrator your Key ID and they will likely be able to find it within a few minutes.
On paper, in a text file, on a stickIt is more common than people expect to come across a BitLockerRecoveryKey…TXT file hidden away in a folder that no one ever opens, or the printed page that Windows offered you during encryption.

From the parcel arriving to the files going home.

Jobs already finished →
01

Booked in the day it arrives, and the first look is on us Free

Your case number is assigned when the item is received. Then an engineer works out what went wrong (no charge). At this point, you receive a basic summary of which parts are recoverable and which are not. You also receive a single written quote for the price of the recovery. Accept the quoted price or turn it down, and there is no obligation to pay anything.

The first look is freeOne fixed figure, in writingNo charge at this point
02

The key search comes before anything else

There is just one key that can open this volume and the characters on screen identify it, which limits the search to a short list rather than a wild goose chase. Was a copy printed when encryption was turned on? Which Microsoft account did the PC sign in with first? Is there a work or college log-in? Has an IT department ever enrolled the machine with Entra ID or Active Directory? Each of these is tried in turn. If all of them are no, this lab is as cut off from the data as you are, and you are told so while the assessment is still free.

The eight-character Key ID notedEvery escrow tried in turn
03

Imaged with the lock still in place

If the disk itself is failing, that changes the running order and nothing else. The copy is taken with the volume still locked, so the mechanism does not have to do a decryption pass, which it would most likely fail before finishing. Everything after that happens on the copy.

Imaged while still lockedThe disk is not asked for more
04

Open the image, then mend it

Once we have found the recovery key, we unlock the copy. If the BitLocker metadata has also become corrupted, we use a Microsoft-provided tool called repair-bde (not a wild guess at a third-party solution). This recreates the volume on media bought in specifically for the job. Rebuilding with metadata corruption needs not only the recovery key but also a backup key package. Backup key packages only exist if they were backed up beforehand, and practically speaking, that means via Entra ID or Active Directory. What it rebuilds is what comes back to you.

repair-bde applied to the imageNew media, bought in for your job
05

The file list comes before the bill

A complete file list will be provided before any invoicing. Simply say "yes" or "no" to what we found: yes means it is billed, no means it is not, and in most cases you only pay if we recover your data. What we find is posted to you on media purchased specifically for your case, at no additional cost to you. We consider the process complete once you have opened those files yourself on your own computer.

Nothing is charged until you agree the figureNew media, bought in for your jobWe pay to send it home

What comes in most often

  • The ID is not the key: eight characters pointing to the actual 48-digit string, which is why the box rejects them however carefully you type them. Give that reference to whoever manages your IT, and the lookup is often a few minutes' work.
  • July 2024 is our example: on 9 July a Windows update pushed entire fleets to the prompt. Ten days later, on 19 July, the CrowdStrike outage affected 8.5 million devices running Windows, by Microsoft's own published count. Many organisations discovered that month that they had never escrowed a single recovery key anywhere.
  • Damaged metadata is not always a dead end: where the BitLocker structures themselves are damaged, repair-bde will write the volume out onto other media, provided it has both a backup key package and the recovery key. In practice the backup key package is only there if it was backed up to Entra ID or Active Directory. The tool cannot generate either one, and finding them remains your task.
  • Sealed and failing? Copy before unlocking: decryption asks for one long pass over the entire surface of the disk, and a disk that is already failing is exactly the one that will stop mid-decryption.

Put simply: no 48 digits, no volume. Both Microsoft and we say that, because a lock that any workshop could easily pick would not have been worth buying. So our bench starts with a search rather than taking things apart: the home account, the work account, whatever IT escrowed, and the printout somebody saved in a binder. If one is found, the files almost always follow. If none are found, no reputable lab in the country is going to get into that disk. You will hear that during your free assessment, not weeks later on an invoice.

One of these, from start to finish.

NG · NTG-2026-1792ON THE LOG ✓

An overnight update, and a Mansfield practice locked out of its own workstation

No one at the practice knew the key already existed. An overnight update changed what the TPM measures, and the workstation now asked for 48 digits that had never been written down anywhere. A Recovery Key ID appeared on the screen. That ID matched an escrow record in the firm's own Entra ID, and that solved the entire problem. Fresh BitLocker metadata was placed on a new disk using repair-bde, and every project file opened normally.

100% of the files back3 days between arrival and return

What helps, and what does damage.

Worth doing first

  • Note the Key ID exactly, all eight characters
  • Sign in at aka.ms/myrecoverykey, then aka.ms/aadrecoverykey
  • Ask your IT department: Intune and Active Directory hold keys for the machines they manage
  • Check for a printout of the recovery key, or the saved .TXT file

What makes it harder

  • Guessing what the digits are
  • Reinstalling Windows to get rid of the prompt (this deletes the files with it)
  • Entering those eight ID characters in the key box
  • Formatting it because you assume the data has gone

Answers before you spend anything.

Where is that recovery key likely to be?

There are four places your recovery key could be, and you should be able to tell which key belongs to your computer before starting: the Recovery Key ID displayed above the prompt is eight characters long. It is unique to that volume and cannot be used for any other. If it is a home machine, the key is escrowed against whichever Microsoft account first set the PC up: aka.ms/myrecoverykey. If it is a company machine, it will have been escrowed via Entra ID, so try aka.ms/aadrecoverykey, then contact whoever administers Intune or Active Directory. Failing all three, go back to the paper copy printed when BitLocker encryption was turned on.

Nobody saved a key anywhere. Is that it?

Yes, this is how the product is meant to work. Microsoft has no way to get at the data inside a sealed volume, and neither does this lab. So unless someone kept a copy of the recovery key, the volume stays sealed. The jobs that end well are the other kind: someone did keep the key, and the real fault turns out to be tired hardware or metadata that needs a rebuild.

Why has the key been demanded now?

The measurement taken at boot does not agree with the one recorded when the volume was encrypted. Firmware updates can trigger it on their own. Changing a Secure Boot setting, swapping the mainboard for a new one or moving the disk from one computer to another can all set it off too. July 2024 is going down in history as the month one Windows update did it to entire fleets at once.

The disk is failing and the volume is sealed. What order?

Hardware first, then keys. We make a copy of the disk while it is still locked and apply the recovery key to that copy, never to your original. Decrypting the original in place needs one unbroken pass over the whole surface, and a worn mechanism is the least likely thing in this building to complete it.

Start here if the same thing is happening to yours.

Windows laptops and PCs → Chip-level SSD and NVMe work → The disk is not detected → Asus and HP laptops → The full device list →

Switched off, a drive cannot get any worse.

The look costs nothing. It gives you a file listing of what opened and what did not, along with the cost of finishing the job, in writing, before anything chargeable begins. In most cases you only pay if we recover your data. Do not switch the drive on until you have that listing.

0115 8220606

Get a quote, then send it Posting it to Manchester