Case notes · Honest limits · MKD-2025-4330
A Firmware Update Took the Fingerprint Tile Away.
The ProBook had signed her in by thumb since it was new. A firmware update ended that — the fingerprint tile has gone from the sign-in page
— leaving a PIN chosen on day one: I set it, then never needed it again
. Four wrong guesses locked the screen. Payroll week, four Leighton Buzzard clients, and eight years of books that aren't mine to lose
.
Same fault? Start here.
0800 6890668
Without the jargon.
Almost everyone confuses two different locks. A Windows sign-in screen protects an account, not the storage. Lift the drive out, read it on other hardware, and that screen is simply not in the way — it was never guarding the sectors. Encryption works the other way about. BitLocker rewrites the volume itself, so without the key or its recovery password what comes off the flash is noise to whoever reads it, ourselves very much included. Which of the two you face decides whether this is an afternoon's work or an impossibility. Finding out costs nothing, and it is the first thing we do.
The kit this job needed.
See how a job runs here →| Kit | Why it was used | What it gives us |
|---|---|---|
| Atola Insight Forensic | Made the protected copy of the NVMe before anyone raised the subject of keys | Fast parallel imaging across several drives, with write blocking and reporting built in |
| PC-3000 SSD | Established the module itself was sound, so no fault could hide behind the lock | Talks to an SSD's controller directly, beneath anything an operating system shows |
| UFS Explorer Professional Recovery | Opened the plain volume at once; the encrypted one followed when the key turned up | Ahead of the pack on difficult filesystems: APFS, ReFS, XFS, ZFS, Btrfs |
What happened on the bench.
Take the copy first; the locks can wait
The NVMe came out of the chassis before anything else and was copied behind a hardware write blocker. On a lockout job that care pays for itself twice. If anyone later disputed who owned the machine, or what had been done to it, we could show the original was never altered. Where nobody ever asks, a careful copy has cost nothing at all.
Read both headers before a price is discussed
The headers settled it inside a minute. The system volume was ordinary NTFS — the sign-in that had defeated her for a week was irrelevant to a direct read. The second volume, holding the client ledgers, carried a BitLocker signature. She had turned it on years back, following a checklist from her professional body, and forgotten. Both halves went into the written quote.
Hunt the paperwork before calling it lost
BitLocker names the key it wants. We read the identifier down the phone. She was certain she had never been given one, then remembered Windows insisting she print a page she did not understand. It was in the ring binder with her practising certificate. The volume opened first time. Without that sheet this half of the case ended there, and she would have been told so.
The outcome.
Both volumes came home. The system side read as though no lockout had happened; the client side opened on a page printed years ago and never once looked at. Payroll ran two days late, on fresh media. The key now sits in three places, and the laptop is not one.
Other jobs from the casebook.
Also under Honest limits.
Does that sound like your device?
One lesson runs through the lot: cut the power, let us look for free, then decide with the facts in hand.