Cause of loss · BitLocker & encryption
That screen is BitLocker doing its job. One of the things it watches has moved — a firmware update, a boot setting, a replaced board — and until the 48-digit recovery key goes in, nobody gets past. Usually the drive itself is healthy and only the key has gone missing. Find the key, and what's left is ordinary bench work.
Run the problem past an engineer
0800 6890668
| On screen | What's behind it | First move |
|---|---|---|
| BitLocker recovery — Enter the recovery key for this drive | Something in the boot chain shifted, so the TPM will not hand the key over | Go and find the key; no guessing |
| Use the number keys or function keys F1–F10 (use F10 for 0). | How the screen tells you to key in those 48 digits | Digits only — your password won't do |
| Recovery key ID (to identify your key): | A short label, eight characters long, that identifies which key you need | Use the ID to locate the key |
| For more information go to: aka.ms/recoverykeyfaq | Microsoft's own guidance page | Your account is where the key lives |
| BitLocker waiting for activation | Encryption is on the volume, but not switched on | You can read it; it isn't secure |
| Encryption sitting on top of dying hardware | Fix the mechanics before the crypto | Clone it first, unlock later |
Every item gets its own case number on the day it lands here. An engineer traces the fault, gives you a plain assessment of what is realistically recoverable, and puts one fixed price in writing. The diagnosis is free, you are under no obligation, and chargeable work starts only when you say go.
Work starts from the Recovery Key ID shown on screen. We follow it through every place a key gets stored: a Microsoft account, a work sign-in, an IT escrow, the printed sheet from the day encryption was switched on. Said plainly — no key, no data, for us or for anybody. Searching beats tooling here.
If the disk underneath is dying, we take a full sector-by-sector copy while it is still encrypted, so decryption never has to run on ailing hardware.
Once the key is to hand the clone opens. Damaged BitLocker metadata is rebuilt with repair-bde, Microsoft's own utility, and the result is written to new media.
You get the full list of recovered files first, and nothing is charged until you approve it. Data goes back on fresh media, return postage paid, and the job stays open on our side until you confirm every file opens at your end.
No dressing it up: a BitLocker volume without its 48 digits stays shut. Microsoft states that plainly and so will we — the encryption would be worthless otherwise. Recovery therefore begins as a search rather than an engineering job: personal account, work account, the escrow IT keeps, a sheet of paper in a drawer. Where the key turns up, the files normally follow. Where it truly does not exist, no honest firm can open the drive, and you will hear that free of charge at diagnosis rather than after a bill.
A firmware update ran overnight and shifted the TPM measurements, so the workstation asked for a key that had never been written down anywhere. We tracked the Recovery Key ID through to the firm's escrow in Entra ID, then used repair-bde to rebuild the broken BitLocker metadata on a clean disk. No project file was lost.
On a personal Microsoft account, start at aka.ms/myrecoverykey; for work or school, aka.ms/aadrecoverykey. Ask IT whether Intune or Active Directory holds an escrow copy, and dig out whatever got printed or saved to a text file when encryption went on. The Recovery Key ID on screen says which one to match.
No. Not us, not Microsoft, not anyone else — the encryption is behaving exactly as designed. The jobs that do succeed are the ones with a key still in existence somewhere, where the true fault sits in the drive or in its metadata.
Something the TPM keeps watch on has stopped matching. Common triggers: an update to BIOS or firmware, Secure Boot settings changed, a repair to the board, the drive moved into another machine — and, for a great many people in July 2024, a Windows update.
Image first, decrypt second. The encrypted disk is copied in full, and the unlock then runs against that healthy copy. Making a failing drive decrypt itself puts the steps the wrong way round.
Switch a failing device on again and you lose a little more. Open a case before you do — the diagnosis is free, whatever it finds.