How it failed · BitLocker & encrypted
BitLocker recovery mode is the machine doing its job: something about the hardware or firmware changed, so it demands proof it's still yours — a 48-digit key. Most 'BitLocker disasters' are key-management problems wearing a scary screen. Find the key, and the rest is engineering.
Talk it through with an engineer
01273 964902
| What you see | What it means | First move |
|---|---|---|
| BitLocker recovery — Enter the recovery key for this drive | The pre-boot recovery screen: the TPM won't release the key automatically | Find the key, don't guess |
| Use the number keys or function keys F1–F10 (use F10 for 0). | Input instruction for the 48-digit key | It wants digits, not your password |
| Recovery key ID (to identify your key): | An 8-character label that identifies WHICH key — it is not the key itself | Match the ID to the right key |
| For more information go to: aka.ms/recoverykeyfaq | Microsoft's default hint URL | The real key lives in your account |
| BitLocker waiting for activation | Encryption enabled but protection suspended | Not locked — but not protected |
| Drive both encrypted AND failing | Hardware fault underneath the encryption | Image first, decrypt second |
Your device is logged with its own case reference the moment it arrives. An engineer assesses the fault, confirms what's actually recoverable, and you get a fixed price in writing — no diagnosis fee, no obligation, and no paid work until you say go.
The Recovery Key ID on screen is matched to the actual 48-digit key — via your Microsoft or work account, IT's escrow, or that printout. No key means no data, for anyone, by design; so this comes before all engineering.
Where the drive is also failing, it's imaged in full first — encrypted sectors and all — so the decryption never has to run against dying hardware.
With the key, the volume is unlocked on the image; where BitLocker's own metadata is damaged, Microsoft's repair-bde pathway rebuilds it onto fresh media.
Before you pay the recovery fee you approve a full listing of what came back. Your data returns on new media with free return postage, and the case only closes once you've confirmed everything opens on your side.
The uncomfortable, useful truth: BitLocker without its 48-digit key is unrecoverable by design — Microsoft's documentation says so and so do we. Which turns the real task into a key hunt: personal account, work account, IT escrow, paper. In our cases, when the key exists anywhere, the data comes back; when it truly doesn't, no honest lab can help — and we'll tell you that for free rather than charge you to discover it.
A firmware update changed the TPM's measurements overnight and the machine demanded a key nobody had written down. The Recovery Key ID led to the practice's Entra ID escrow; damaged BitLocker metadata was rebuilt with repair-bde onto a new drive, and every project file survived.
Check your Microsoft account at aka.ms/myrecoverykey, your work or school account at aka.ms/aadrecoverykey, your IT team's Active Directory or Intune escrow, or the printout or text file you saved at setup — and match it by the Recovery Key ID on screen.
No — not by us, not by Microsoft, not by anyone. That's the product working as designed. The recoverable cases are the ones where the key exists somewhere and the drive or metadata is the problem.
Something the TPM measures changed: a BIOS or firmware update, a Secure Boot change, a motherboard repair, moving the drive to another machine — or a Windows update, as happened at scale in July 2024.
Image first, decrypt second. The full encrypted drive is imaged so the unlock runs against a healthy copy — a dying drive should never be asked to decrypt itself.
Every restart of a damaged device costs data. Open a case first — the diagnosis is free either way.