A blue screen requiring 48 digits that nobody has ever written down, with either a business or a household on the wrong side of it. In the Norfolk area, we locate escrowed keys, we open leavers' machines in large quantities at one time, and we get failing encrypted disks back through the inside of the cipher, as opposed to going around the edge of it, because there isn't anywhere that has an actual working version of cracked BitLocker.
Every BitLocker job is diagnosed free. The quote follows in writing, fixed, before a screwdriver is lifted.
In most cases you only pay if we recover your data. Electronic, mechanical, chip-level and physical work is charged at 50% upfront. Ransomware, forensic, BitLocker and CCTV/DVR jobs are charged 100% upfront on acceptance of our fixed quotation. Please refer to the data recovery cost page for full details on costs.
The first step in any BitLocker job is to match the cause of the problem to the symptoms, and after twenty-odd years, there are thirty causes that account for just about every issue we see walk into our shop.
Something has changed either on the hardware or firmware and unsettled the TPM's measurements. As a result, the data is now only one long number away. That number can usually be found, which is this whole page in a sentence.
Most of these end at escrow: a forgotten Microsoft account sign-in, a directory entry somewhere, an exported file, a print-out under a stapler. We have a systematic approach that yields results more often than not.
Weak to moderate strength passwords yield to fast GPU-based attacks. Strong passwords that are truly lost get a definitive "no" rather than an optimistic bill.
Swapping motherboards, clearing the TPM, flashing a new BIOS, toggling Secure Boot: all trip the protection (as they were intended to), but the recovery key will "untrip" them.
A data partition that has been orphaned by a reinstall can be unlocked once its key is found. All the data is still present on the drive; nothing of consequence was moved during the reinstall.
Compound cases (hardware failing under encryption). Captured whole while still locked, then decrypted from the stable copy instead of the failing original.
Encrypted removable media uses the same three doors as encrypted system drives: the key, the password, or forensic key recovery, in that exact order.
Bulk decryption of drives formerly used by employees, using the organisation's escrowed keys, with each drive matched to its own key by its unique identifier, rather than by guessing which key unlocks which drive.
Once removed from its TPM, a volume locks itself (this is expected behaviour and not an accident); it takes a few minutes to unlock after obtaining the correct key.
Once BitLocker's own structures have become corrupted, but there has been no damage to the physical drive, the backup copies are located and used to rebuild the headers, and then decryption can proceed.
The TPM is wiped. 48 digits are demanded. Nothing else changes. Recovery happens via escrow, or through whatever remains in the TPM.
Changing the bootloader (or installing Linux) creates different measurement values. That's when you'll see the prompt. It's completely predictable, easily reversible, and seen every week.
Most modern laptops enable device encryption silently as soon as you sign in for the first time. Owners typically discover this at the worst possible time: while locked out.
Intune and Active Directory store keys none of us knew existed. Finding each of those keys and matching each with its drive based on its identifier is tedious work, but most often it works.
Over the years, accounts collect multiple keys, and invariably the "wrong" one is tried first. Matching on the identifier of the key displayed on screen eliminates all guesswork.
Computers that boot from a key file on a USB stick will lock solid if they do not have the USB stick. The escrow and TPM routes remain open regardless; therefore, it is not the end of the road.
A TPM and PIN setup that has not been used for months seems to fade from memory. However, the way back in is via the recovery key, and one can usually be found.
Business dissolved, directory deleted and drives stored in a box in somebody's garage. Whatever escrow paths remain (and the TPM) are pursued instead.
Encrypted to the previous owner's account and can only be recovered with the previous owner's lawful cooperation. This is stated before any money changes hands as opposed to after.
If a decryption run was interrupted by loss of power, half of the cipher is left on the disk. It is salvaged from an image, with each half processed properly based on where the boundary fell.
External drives set to auto-unlock will no longer do so after a reinstall of Windows, due to the stored key leaving along with the old Windows. Typically, escrow still holds its twin.
Hardware drives that perform BitLocker's encryption inside their own chips have their own failure modes, and the older trust model for these devices had documented weaknesses. These are handled at drive level, and candidly.
The sole copy of the recovery key, saved as a plain text file on the exact same volume that it opens. Ironic? Yes, we think so here. Escrow thinks it's less funny.
When operating in "used space only" mode, the files themselves are encrypted while the free space on the disk, including older deleted copies of those files, is left unencrypted. Carving can recover data from areas the encryption never covered.
A game needed TPM and Secure Boot changes, and at the next startup it demanded 48 digits. This is the most common road to this page among younger callers.
In managed estates, the recovery keys are rotated automatically; a laptop that has not checked in since the last rotation is protected by a key that has been replaced in the directory. Therefore both keys will have to be recovered (the present and old) and normally the older key is the one that works.
When you use standard consumer cloning software to make an image of an encrypted drive, it frequently creates a copy that is the wrong size, misaligned, or even worse, missing the volume header entirely. The encryption is fine and the container is not. Rebuilding it from the original is simple; rebuilding it from the clone is not.
If you have a data partition that is encrypted separately from your system drive, then each has its own separate key, and typically only one of them gets written down. The identifier displayed on screen tells us which key is being requested, and the search proceeds from there.
Security chips prevent guessing attacks by closing the door after a run of incorrect PIN entries (sometimes for hours) or until the machine has been left powered down overnight. Patience is indeed the answer, and pounding on it will extend the lockout as opposed to reducing it.
BitLocker can also be unlocked via a smart card or a certificate in place of a password. That's nice until your smart card gets lost or the certificate expires with your old IT provider. The remaining routes are escrow and the TPM (Trusted Platform Module), and we will tell you as part of our diagnostic which of them is still open.
Most keys reported as "lost" have never been lost. They have simply been filed in some place that was overlooked. Windows very seldom encrypts anything without first keeping a copy of the key (or "escrow") somewhere, such as a user's Microsoft account, a workplace Azure AD tenant, an on-premises directory, a text file exported and then forgotten, or a printout that was put in a drawer during a rushed handover. Newer laptops automatically enable device encryption when users first sign in. As a result, many households end up locked out of drives with no prior knowledge that those drives were even encrypted. Therefore, the first step against any lockout is a patient search through every account and directory the machine has ever touched. This process can be tedious but it resolves more cases than any of the clever tooling does.
Decryption here runs on Passware Kit Forensic, the tool the forensic trade uses, and it is worth being precise about what this means. Nobody can defeat correctly implemented AES, whatever a confident-sounding website says this week. Passware doesn't break ciphers; it gets keys back from hibernation files and memory captures, from the TPM itself, or via GPU attacks on human-chosen passwords where there isn't anything else guarding access. BitLocker and BitLocker To Go make up the everyday work, side by side with VeraCrypt, FileVault, TrueCrypt and LUKS, and batches of drives from departing staff are routinely decrypted for employers.
A disk which is failing while it is still encrypted needs its operations to occur in a specific order, and an attempt to unlock the disk should never be your first action, as each attempt uses up some of the drive's remaining healthy running time and proves nothing. The disk gets copied cold and still locked onto imaging hardware, and once a valid key has been found, decryption is run against this stable duplicate. Before you commit, there is one thing to know: BitLocker is classed as forensic work, so the initial assessment occurs without cost, the fixed price quote follows the assessment, and that figure is paid before the work begins, rather than after.
BitLocker recovery is essentially finding the key with discipline and controlled imaging, never "code breaking". The equipment reflects exactly that:
The key-recovery suite the professionals rate. Keys are pulled from memory captures, hibernation files and security chips, or reached using an accelerated password attack. The tool finds keys; the AES below remains unbroken, for us and for everyone else.
If the machine still boots, you can sometimes pull the live key out of RAM or directly from the hibernation file. It's the fastest lawful way in when it is available.
Graphics processing units mounted side by side in racks, running dictionary and brute force attacks at many thousands of attempts per second, around the clock.
An encrypted drive that is failing is copied in its entirety (from start to finish) while still locked, behind a write blocker. Decryption then only happens on the stable duplicate copy.
Simply a matter of going through all of the Microsoft accounts, work directories, exported files and even paper in desk drawers, which is where most lockouts end up being solved.
BitLocker and BitLocker To Go first, then FileVault, LUKS, VeraCrypt and TrueCrypt, along with several hundred other types of password protected files.
A sound BitLocker volume without its key remains closed, whatever a confident advertisement will say. Genuine recovery here means obtaining the key: escrow trawls, work on the TPM, password attack at GPU speed, and a straight answer where the key has really gone. Forensic in nature, the work is paid upfront once you accept the fixed quote, rather than on results, but getting to that quote costs you nothing. The person answering the phone is an engineer, and can be reached on 0800 689 0668.
Send all the key information you have, including the 48 digit key (if anyone has written this down), any Microsoft or workplace accounts that might be holding escrowed keys, exported key files, PINs and all possible passwords as well as their variations. Each piece of information will save hours on the process. The drive itself travels well in a standard anti-static bag, or in aluminium foil if that's what is available. Please send it by tracked and insured post, arrange your own courier, or bring it to reception at our Cambridge location, Monday to Friday, 9am to 5:30pm. We do not collect.
Most items arrive at this bench by insured and tracked post. We recommend getting a quote first, either by telephone or using our free online diagnostic, and once you have received your quote, simply post the item. Post is the steadiest way to move a poorly drive, and a parcel sent from Norfolk typically arrives on the bench within a working day.
Is the drive still bolted inside a laptop, desktop, MacBook, iMac, server or CCTV / DVR recorder? Before sending, remove the hard disk drive (HDD) or solid state drive (SSD), as we do not accept whole units. From a DVR or recorder, send just the disk. From a server or RAID, take out the disks and clearly label each disk by bay number. A network attached storage (NAS) device may be sent as its disks if they can be removed; otherwise please send the NAS itself. There is only one type of drive we are unable to accept: storage soldered onto a motherboard (e.g. Apple Silicon Macs, extremely thin laptops). In such cases, if the storage cannot be taken out it cannot be accepted. If you are unsure whether you have a removable drive or not, call us before sending anything.
↓ Print the shipping & booking-in form (PDF)
Please mark the parcel for the attention of Cambridge Data Recovery. It takes about an hour and twenty minutes to travel from Norwich along the A11, then two minutes off the A14 at Junction 32. Otherwise you can post it using a tracked service and we will receive it the following working day. We will contact you as soon as we have your drive and it is booked onto our bench.
If you're unsure of what to include in the box, please call us on 0800 689 0668 before sealing it. Or, for a first view on what we can do, you can use our free online diagnostic.
Free diagnosis, one fixed figure written down, and in most cases you only pay if we recover your data. Start online or ring us.