BitLocker asking you for a 48-digit number means it is doing its job, not failing. Most times, the key is stored online by default — thus the first thing to do is figure out who configured the computer, so you know where to find the recovery key. And if the drive has failed as well, the order of work matters more than most people expect.
Before any recovery company opens a locked Windows machine running BitLocker, they need one of two things: the 48-digit recovery number, or the login name and password it is tied to. Check all of these locations first: your Microsoft account, Azure AD or Entra, Active Directory, a printout made at setup, a file on a USB stick, and your password manager.
There are really only two possible places you could find the 48-digit recovery number, depending upon who initially set up the Windows operating system — so start there.
A personal machine. If you logged into Windows using an active Microsoft account during setup, then it is very likely that the 48-digit recovery code is stored within your Microsoft Account. Sign in at the Microsoft recovery-keys page — it will list every recovery key associated with each device in your account. If you cannot locate it online, check your physical records and also your password vaults and any flash drives lying around.
A work machine. Don’t spend an afternoon hunting – ask your IT administrator. Corporate estates escrow keys for BitLocker centrally in either Azure AD or Entra on modern setups, in Active Directory on older domains or through Intune when devices are managed. This can take an admin only a couple of minutes. This one question will resolve more BitLocker queries than anything else we do.
The volume is sealed to the machine it lives in so the prompt means the machine no longer looks the way it did.
The TPM releases the key automatically only when the boot environment matches what it measured when encryption was switched on. A firmware or BIOS update changes those measurements which is why the prompt so often appears the morning after an update ran overnight and why it catches out entire fleets at once when an estate updates together.
This is true for everything that changes the boot path too: toggling Secure Boot; changing the boot order; adding a new device before your disk; moving the drive to another machine. The last one is how the program works just like it should — a stolen disk shouldn’t open on a different machine. Also, if you enter your PIN incorrectly many times, or your Windows updates are slow enough they stall, the volume will drop into recovery mode. The same happens when a drive starts to fail — which is the reason most worthy of attention.
Not all lost keys mean the end of the road — but it depends entirely on what the password was.
If the 48-digit recovery key is nowhere to be found, then we have a second option: attack the password itself. We run professional password recovery on BitLocker volumes with our GPU-accelerated tools based on anything you can give us — part of a memory; the usual pattern you used; a date or a name that could have been in the password; an older password from around the same time.
You should be clear in your mind as to what that means. The encryption is intact. It isn’t “breaking” anything. It is rapidly trying candidate passwords until they find one that works. Rapid guessing succeeds if the password was too short, used somewhere else, had an easily guessed origin, or if there were some pieces that could help to narrow the search area. Hardware will never change the mathematical fact that it won't work with a long randomly chosen passphrase — anyone telling you otherwise is selling something that does not work.
The recovery key — an enormously large string of numbers — is not a realistic target for this sort of thing. This recovery key is intended to prevent exactly that type of attack. What password recovery finds is a user-selected PIN or password. This is an entirely different proposition.
This is the case where a lab actually adds value, since the order in which you do things determines the end result.
If the physical drive holding a BitLocker volume is also failing, then attempting to unlock it prior to any other operation on the drive is incorrect. A decryption pass reads the entire BitLocker volume. Hours of continuous activity put the drive that is already failing at risk. These hours would have to occur prior to having read even one file securely.
The initial step when attempting to access an encrypted hard disk is to create an exact read-only image of that disk. The next step involves using the copied image to unlock the encrypted data instead of relying on the failing disk for that process. This means an unstable disk only has to hold together once, and every read the drive has left is preserved. When bad sectors exist within the disk, our software takes the image through those areas while logging the gaps where data cannot be retrieved. Finally, BitLocker's internal verification methods will indicate which sections were unable to be recovered, thereby allowing our customers to receive complete information about their disks' recoverability status and avoid receiving corrupted data due to failure.
This pricing structure is based upon two different jobs and reflects how we view each scenario.
When a customer's encrypted drive is in good condition and they possess the required decryption key(s), unlocking the data contained in the drive is considered a 'short job' versus a full-blown "data recovery." As such, we price it as a short job. On the other hand, when an encrypted drive fails, we charge a flat £800 + VAT. The time frame associated with completing the job depends upon how long it takes us to successfully create a quality image of your drive. Typically, we require between 3 and 4 working days to accomplish this task.
We provide every potential client with a complimentary 48-hour diagnostic, along with a written quote, prior to beginning any services. If we determine during that diagnostic that the encryption key genuinely no longer exists anywhere, we will notify them accordingly. Because no amount of work will recover the data, the customer will incur no costs.
Send the device in with an initial report of what has occurred to it. The diagnosis is at no charge and commits you to nothing, and the subsequent fee is written as a firm price prior to opening anything.
This is the only step that requires input from you and nothing else can happen until the device is on our bench. Package your item properly and include all the information we require about you and your item(s), then ship them to us. Then comes a no-cost diagnostic, followed by a written quote.
Posting it? Use a tracked and insured service. The value of what is on the drive far exceeds the cost of postage. Bringing it in? Weekdays from 9am to 5:30pm, and it still needs packing as described above for the journey.
Tell us about the item in question, tell us how it has been behaving lately, and let us know if there is anything you have done as far as troubleshooting goes so that our engineers may provide a realistic estimate of success and a probable cost range prior to sending your items off.
We’ll be in touch shortly. For anything urgent, call 0161 871 0788.
We get asked the same questions most often about how to recover BitLocker & encrypted drives.
Maybe. Where the key is genuinely gone, we're able to use our GPU-based password recovery tools to test candidate passwords as quickly as possible based on anything you can recall about your password. Those methods work well with short, reused or partly remembered passwords. They never work on a long, completely randomly generated phrase (or pass-phrase), and the 48-digit recovery key was designed specifically to be resistant to all of these methods. We'll give you an honest assessment of what we think you're looking at.
It is usually whoever manages your company's IT. A lot of corporate environments store their encryption keys with Azure AD, Active Directory or Intune. An IT administrator should be able to pull that out within a couple of minutes. Before spending money trying to recover a lost key, ask if they can provide access to it — it resolves more of our "I've lost my key" enquiries than any technical work we do.
This occurs because the trusted platform module (TPM) only shares the encryption key if the boot environment looks like what was measured during initial setup, and firmware or BIOS updates change these measurements. It is by far the most common trigger, and it catches whole enterprise fleets at once when identical updates are applied across all systems simultaneously.
The sequence is changed. Decryption first means an entire decryption pass over a disk which may not last until a single file has been protected. We image the drive read-only first; then open the volume from that copy.
Yes, you can. And it will request the recovery key once you do — the key is locked to the TPM on the original machine. This behaviour is intentional and why someone who steals a laptop cannot use its disk.
£800 + VAT flat fee if the physical drive has failed, quoted after a free 48-hour diagnostic. If you have the key and the drive is good, it's a small data extraction task and billed accordingly. If we establish there is no key left, we tell you, and there is no charge.
Free diagnostic. Quick ownership check. Your encrypted drive opened and handed back decrypted. Failing disk included. Contact us and we'll take care of it.