Lab notes · Where limits sit · CDF-2025-0330
My Thumb No Longer Opens the Laptop.
Her thumb had opened the ProBook from the first day she had it. Then an update took that away — there is no fingerprint icon on the sign-in page any more
— leaving a PIN she had chosen on the first afternoon and never typed since: I set it the once, and after that the reader did it for me
. Four wrong guesses and the screen shut her out altogether. It was payroll week, four clients in Pontypridd were waiting, and on that machine sat eight years of accounts belonging to other people
.
Does that match yours? Call us.
0800 6890668
Why that happens.
Take the storage out of the laptop, put it on other hardware, and you learn at once which of two locks you are dealing with, because they are nothing like each other. A Windows sign-in guards an account. It guards nothing else. The screen that has beaten you for a week has no hold whatever on the sectors underneath it; unbolt the module and it is not in the way at all. Encryption is a different animal. What BitLocker locks is the volume, rewritten from the inside out; lacking the key — or the recovery password that does the same job — anything lifted off the flash comes back as noise, on this bench as surely as anywhere else. One of those is an afternoon’s work. The other cannot be done, by us or by anyone. Finding out which you have costs nothing, so it is where we start.
What we used on this one.
Every step, in order →| The tools | What it did here | Why it helps |
|---|---|---|
| Atola Insight Forensic | Imaged the NVMe behind a write blocker, before anyone mentioned a key | Images several drives at once, write-blocked throughout and logged end to end |
| PC-3000 SSD | Confirmed the module was electrically sound, so nothing behind the lock was broken | Speaks to the flash controller itself, below whatever an operating system chooses to report |
| UFS Explorer Professional Recovery | Mounted the open volume straight away; the other waited on its key | Reads the volume formats that defeat most software: APFS, ReFS, XFS, ZFS, Btrfs |
How it went.
Image it before anyone argues about locks
Before anything else was done, the module came out of the chassis and went onto a hardware write blocker to be copied. On a job like this one the habit earns its keep twice over. Should anyone later query who owns the laptop, or what was done to it, the module can be produced exactly as it came in. Should nobody ever ask, the care cost nothing.
Read both headers before putting a price on it
A minute spent at the headers settled where we stood. One volume held the system and was ordinary NTFS — against a direct read, the screen that had beaten her all week counted for nothing at all. The other held the ledgers, and it came up with a BitLocker signature on it. Years back she had switched that on, working down a checklist sent round by her professional body, and had not given it a thought since. Both were priced into the single written quote.
Hunt for the printed key before writing it off
BitLocker will tell you exactly which key it wants. That identifier went to her down the phone. Nothing of the sort had ever reached her, she was certain — and then she remembered Windows badgering her about printing something she could make no sense of at the time. The sheet was in a ring binder, tucked behind her practising certificate. First attempt, the volume opened. Had that page not survived, that volume would have stayed shut, and we would have said so plainly.
Signing it off.
Both volumes went back to her. The system side read as if it had never been locked at all; the ledgers opened to a piece of paper printed years earlier and never afterwards looked at. Payroll ran two days behind, delivered on fresh media. Three separate places hold the recovery key now, and the laptop is not among them.
Pages people often read next.
Cases that hit a limit.
Is that what yours is doing?
Power it down, get it to us, and hold off on any decision until the diagnosis says what can still be read.