The blue screen with a request for 48 digits is an indication that BitLocker is functioning properly, not failing. Understanding what caused the trigger will help determine how quickly you will get back up & running. Where the drive itself has failed as well, the order of operation is much more important than many think.
There is no recovery company that can decrypt a BitLocker volume without either the 48 digit recovery key or the account credentials associated with it. Check your Microsoft account, Azure AD or Entra, Active Directory, the printout from when you set it up, a text file on a USB stick & your password manager before investing.
BitLocker “seals” the volume to the machine it resides in. Recovery mode is not a fault; it is simply a result of the seal detecting changes in the machine environment.
It’s been found that the key is stored automatically much more frequently than you’d think; check through these possibilities prior to deciding it has been lost.
When using BitLocker as long as there is a Microsoft account logged in to the Windows device then by default the key is backed up to that Microsoft account. Look at the “Recovery Keys” tab for that Windows device.
If you are accessing from a work machine then most likely the key was escrowed to your company tenant and your IT administrator should be able to get the key directly.
Many domain joined computers will store copies of their recovery keys in Active Directory. This is typically done because AD policy dictated it.
When you switch on encryption, many times users agree to save/print the key.
In some cases the key will be stored on removable media (for example, USB drives) especially with older or manual configurations of an install.
The estate stores keys centrally in managed environments, which is commonly missed by users as they didn’t see it.
In this scenario a lab will add value, as the order of operations does matter.
If the drive containing the BitLocker volume is also failing, attempting to unlock it first would be counter-productive because each decryption pass reads the entire volume; this process takes hours of continuous reading by a disk that may fail in doing so. First the drive is imaged as read-only (so nothing can be written to it), then the volume is unlocked from that image instead of from failing hardware.
This sequence preserves all of the reads that the drive has left, and therefore allows an unstable disk to only have to remain stable once. On drives that contain defective or “bad” sectors, we will take an image of the data past those sectors while logging where the sector gaps are located. Then, since BitLocker includes its own set of integrity checks, we can use these checks to determine exactly what sections of data were not recoverable, rather than generating silent corrupted results.
These represent two very distinct scenarios and will be priced as such.
If your drive is in good condition and you still have the key, then it’s an easy extraction as opposed to a full restoration, and we’ll tell you that. If the drive has failed, one encrypted drive is from £300 +VAT with the timing of when you get it back depending on how long the imaging takes. Typically this takes 3 to 4 working days.
We always start every new case off with a complimentary 48 hour diagnostic and a written quote. In most cases you only pay if we recover your data. Drive level physical jobs require a 50% deposit with the final amount being paid only after the successful completion of your data recovery. A full write-up: a BitLocker laptop with the key long gone.
We will perform a free diagnosis of your device upon receipt, and ask some questions as to what may have occurred, after which one of our engineers will then provide you with an exact written quotation prior to performing any work.
Before dropping off or posting your device please request a quotation either by telephone or using our quotation form. The first step to recover your data is to get the device to us. Please ensure that you pack the device securely, include your contact information and then forward it to us. Once we have completed the free diagnostic of your device we will provide you with your exact price in writing prior to commencing any further work.
Posting it? We would suggest using a tracked and insured delivery method. Want to drop it off? That’s okay too. Monday to Friday, from 9am to 5:30pm is good; no appointment necessary: simply prepare the item as described above.
If you want a few more details first, fill out this form and let an engineer go through it and send you back a custom quote.
We’ll be in touch shortly. For anything urgent, call 01865 593000.
The most common questions we receive regarding recovering BitLocker and encrypted drives.
Unfortunately, no and neither can anyone else, even Microsoft. This is what full disk encryption is all about. Be very cautious of any company claiming they can decrypt your BitLocker encrypted drive. We can recover your drive and provide you with access to the volume from our image, but only after you give us your key.
Because something it trusted changed (e.g. a firmware or BIOS update; a secure boot or boot order was changed; the drive was moved to a different computer; a Windows Update went wrong; repeated incorrectly entered PINs). The issue isn’t with the seal itself, but with what that seal relies upon.
First go to the Microsoft account recovery keys page. Then check Azure AD or Entra and Active Directory on a work device. Next, check any printed out or saved files from when you originally set up the encryption. A USB stick may have been used as well. Your password manager could be holding them too. And if you use an MDM / Intune console they may be there too. They are stored somewhere automatically much of the time.
Once you have your recovery key(s) and a healthy hard drive, unlocking can take just a few minutes. However, if the hard drive is bad, the amount of time it will take to unlock depends on how quickly the image of that hard drive can be created. This typically takes 3 to 4 working days. We offer a complimentary diagnostic within 48 hours to tell you where you stand.
Imaging is done before any unlocking. When doing a decrypting “pass” through an entire volume, depending on how long it takes, this can be stressful, and there is no guarantee that a failing hard disk will remain intact. Therefore, we do a read-only imaging first and then use the copy to unlock, so the original drive only needs to remain operational once.
From £300 (plus VAT) for an individual encrypted drive with hardware failure; this price is quoted in writing after a free 48 hour diagnostic. If the drive remains operational and you are able to provide access to the encryption key, then this is likely to be a relatively short process and we would quote accordingly.
Free diagnostic, quick ownership check, your encrypted drive unlocked & returned decrypted, including a failing disk. Please get in contact and we’ll take care of everything else.