The dreaded blue screen asking for 48 numbers no one had written down, blocking access to a company's own files. For York companies and homes we provide escrow recovery of keys, bulk-decryption of former employees' drives, and recover failing encrypted disks through the original cipher, never by cracking it, as there is no such thing as cracked BitLocker.
All BitLocker jobs are diagnosed at no cost. You get a fixed quote, in writing, before a tool is lifted.
In most cases you only pay if we recover your data. Chip level, electronic and mechanical repair is charged at 50% at start-up, and the other 50% only upon successful recovery of your data; all BitLocker, ransomware, forensic and CCTV/DVR recoveries are charged at start-up when you accept our fixed quote. More information can be found on the data recovery cost page.
The first step with each BitLocker drive is to match the symptoms to the fault. After 20+ years of doing this type of work, these 25 problems account for almost every single job that passes through our door.
There was either some sort of hardware or firmware change which caused the TPM's measurements to become unsettled, and your data has been separated from you by just one very large number. That number is usually locatable.
Mostly they stop at escrow: an old Microsoft account that no one remembers, a directory listing, a file export, or a print out stuck under the stapler. We search methodically.
Poor and moderate passwords are broken with an attack using a GPU. Very good lost passwords get you a straight verdict rather than an invoice with hope.
BIOS flash, Secure Boot toggle on/off, motherboard swap, TPM reset: all of these things will trip the protection just like they were designed to. The recovery key undoes it.
A data partition that was left behind after a reinstall can be opened as soon as its recovery key turns up. The reinstall did not move anything underneath.
Compound case: hardware is failing underneath encryption. We capture the entire contents while still locked, then decrypt afterwards from the stable copy.
Encrypted removable devices answer to the same three doors as system drives: key, password or forensic key recovery. The order is the same for both.
Ex-employees' drives are decrypted in bulk using organisational keys that have been escrowed, each matched to its drive by identifier.
Once removed from its TPM, the volume locks: behaviour, not bad luck. With the key in hand, it takes minutes to recover.
If BitLocker's own structural elements become corrupted on an otherwise fair drive, the backup copies are located and the headers rebuilt prior to decrypting the drive.
Security chip cleared, 48 digits required. Recovered through escrow, or coaxed from what the chip still retains.
When you install Linux or reconfigure the bootloader, measurements are changed and the prompt appears. Reversible and predictable; occurs every week.
Most modern laptops switch on silent device encryption as soon as you log in for the first time. The owners usually find out about this when they get locked out of their computer, which isn't ideal.
Intune and AD have keys that no one knows exist. We identify those keys with identifiers we match to disks using tedious but successful methods.
Many accounts collect multiple keys and the wrong one gets tried first. Removing the guessing process by matching the keys with the IDs displayed on the screen eliminates that problem.
Machines that boot from a USB key file will lock solid without it. Whether you use escrow or the TPM, those routes remain open regardless.
After months of no use, the PIN on a TPM plus PIN setup fades from memory. Normally, you can find the recovery key, which is the way back in.
The TPM and remaining escrow options are used when the business has been dissolved, the directory deleted and the drives left in a box.
We state this before any money changes hands, as the data was encrypted to the previous owner's own account. This means we will need the lawful assistance of the previous owner to access the data.
A manage-bde run that was interrupted due to loss of power results in a "half" cipher. The sectors are salvaged one by one from an image, and both halves are processed properly.
Any external drive configured to auto-unlock stops working after a new Windows install, as the stored key stayed with the old Windows. In most cases, the escrow holds a copy.
Hardware SEDs that perform BitLocker's functions in the drive itself fail in their own ways, and the old eDrive trust model had known holes on record. We handle these failures at drive level, and we're candid about them.
The sole copy of the recovery key is contained within a text file on the volume that the recovery key unlocks. Yes, we see the funny side, but escrow doesn't find much humour in it.
Used-space-only mode encrypted the user data, but left the unused areas of the drive in plain text. This included older copies of deleted documents. Carving reads whatever the cipher never covered.
A game required players to change their TPM and Secure Boot settings. They then needed to enter a 48-digit code upon reboot. It seems many gamers found their way here via this path.
Most "lost" BitLocker keys were never actually lost; they simply weren't located. Windows rarely encrypts without storing the key in escrow first, for example in a Microsoft account, workplace Azure Active Directory or an on-premise directory, an exported text file with the key, or a printout at the bottom of a drawer. Many modern laptops will turn on silent encryption the first time you log into your device, which is why users often find themselves locked out of drives they never even realised were encrypted. Therefore, when resolving a lockout, the starting point is to methodically search through each account and directory that the device has interacted with historically. While not glamorous, it resolves more situations than any advanced tooling.
Forensically, the decryption side uses Passware Kit Forensic, which is the software used by the forensic industry as well. We want to be clear about what it can and cannot accomplish. No one will crack correctly implemented AES, no matter how sure some websites claim they can. Passware recovers keys: from memory captures and hibernation files, from the TPM (Trusted Platform Module), or via GPU-driven password attacks where a human password guards the volume. BitLocker and BitLocker To Go are the staples, while VeraCrypt, FileVault, TrueCrypt and LUKS all receive the same treatment, and estates of former employees' drives are routinely bulk-decrypted for employers.
In an encrypted hard drive failure, the right order of operations matters, and unlock attempts are exactly the wrong one. Each attempt uses up the drive's last remaining good hours while proving nothing. Therefore the failing, encrypted drive is imaged in its locked state on hardware rigs; after the image is created, decryption runs against that stable copy using the recovered key. Before you commit, make sure you understand that BitLocker sits in the forensic class: the initial assessment will cost you nothing, the fixed quote follows the assessment, and payment is made before any work starts.
Key-finding plus disciplined imaging = all of BitLocker recovery. Never code-breaking. Our rigs are set up exactly that way:
This key recovery suite is the one the forensic community rates: it finds keys in memory captures, hibernation data and TPMs, or reaches them by accelerated password attack. And yes, Passware finds keys, but AES remains unbroken for us as well as everyone else.
Occasionally, when the computer still boots up, you'll be able to pull the live key from either RAM or the hibernation file. This is the quickest legal way into your data.
Brute force attacks run at tens of thousands of password attempts per second on racks of graphics cards, day and night, as they grind through dictionaries.
A deteriorating encrypted drive has its whole contents copied while still locked, write-blocked end to end, and decryption afterwards works only on the stable duplicate.
This methodical search (Microsoft accounts, work place directories, exported files, paper in drawers) is where most lockouts are actually solved.
First BitLocker and To Go, then FileVault, VeraCrypt, TrueCrypt and LUKS, plus several hundred password-protected file types.
Sound BitLocker without its key stays sealed, whatever a confident advert says. A true recovery means recovering the key: searching escrow, TPM work, or a brute-force attack against the password with GPU acceleration, along with a clear verdict when the key has genuinely been lost. This is classified as forensic work, so it is paid upfront once you accept the fixed quote rather than based on outcome, while getting that quote costs you nothing. The person who answers the phone is also an engineer, not a scripted response.
After you receive your quote, post any key information that you have (or think you may have) along with the drive. This includes the 48-digit key if it was ever written down, any Microsoft or workplace accounts that might hold the escrowed key, exported key files, PINs, and your best guesses at passwords with their variants. All of these will significantly reduce the time spent on the recovery. The bare drive itself may be placed into an anti-static bag or, at a pinch, aluminium foil.
Get a quote first, by calling us on 0800 689 0668 or using our free online diagnostic tool. After receiving your quote, tracked and insured post is how nearly every job reaches us: it is the fastest and safest way to get your drive to our lab in Leeds. There's no collection service, so the parcel is yours to send, or you can hand it in at the Leeds lab's reception.
Is the hard drive or SSD still inside a machine, such as a laptop, MacBook, iMac, CCTV/DVR system or server? Please remove the hard drive or SSD from the machine first and then post just the bare drive by itself; we do not provide a service for removing drives from devices. For a server or RAID, send every disk, each clearly marked with its bay. For a NAS, send its disks labelled by bay if you can remove them, otherwise send the NAS itself. We cannot work on storage soldered to the motherboard (e.g. Apple Silicon Macs, T2 Macs and certain slim laptops): if it doesn't come out, it can't come in. If you are unsure whether your storage is removable, call us before sending.
↓ Print the booking-in & shipping form (PDF)
Once you have your quote, send your package addressed to Leeds Data Recovery (about a 40 minute drive from York on the A64 & A1(M) or next working day if you want to send it using trackable post). We will contact you as soon as we have taken delivery of your package and put it in line to be worked upon.
Can't figure out what to pack? Ring 0800 689 0668 first, or try our free online diagnostic tool.
Free diagnosis, fixed written quote, and on most work you only pay if we recover your data. Start online or call our freephone.