Cause of loss · BitLocker & TPM lockouts
A machine stuck at the 48-digit prompt is seldom a broken one. The TPM measured the hardware and boot path at setup; something has changed since — firmware, a Secure Boot setting, a new board — so the chip keeps the key to itself until you type the recovery key in. The disk underneath is usually fine. Finance is Cardiff's biggest private cluster, its laptops encrypted by policy, so most begin with sign-ins, not screwdrivers.
Describe the symptoms to an engineer
0800 6890668
| Warning signs | What has gone wrong | Do this now |
|---|---|---|
| A blue boot screen asking for the recovery key to this drive | The measurements taken at boot have changed, so the TPM keeps the key sealed | Go looking for the key; never guess |
| Use the number keys or function keys F1-F10 (use F10 for 0). | Just the instructions for entering the 48 digits | Numbers only; no Windows password will work |
| Recovery key ID (to identify your key): | Eight characters naming the key this particular volume wants | Match that ID against the escrows |
| For more information go to: aka.ms/recoverykeyfaq | Microsoft's own help page | The key is sitting in your account |
| BitLocker waiting for activation | Encryption is configured on the volume but has never run | Wide open to anyone; nothing is protected |
| A locked partition on a disk that is dying | Sort the hardware out before the key | Image it sealed; open the image |
The diagnosis costs you nothing. Every item that arrives is logged under a case number of its own, and an engineer works out what has actually failed — then tells you plainly which files can come back and which cannot. The price follows that: one fixed figure, in writing, and no work begins until you have read it and said go ahead.
It all turns on the eight characters printed above the prompt: they identify the one key this volume will take. After that it is a list to work down — the Microsoft account someone used to set the machine up, a sign-in from work or college, whatever your IT team escrows into Entra ID or Active Directory, plus the sheet printed at the time. No key, no way in, for us or for anyone.
When the disk is failing, every sector is copied with the encryption still in place, so a mechanism already on its last legs is never made to sit through a decryption run.
The image opens as soon as the key surfaces. Where the BitLocker metadata has been damaged as well, Microsoft's own repair-bde rebuilds the volume onto separate media, and your files go home on new storage.
Nothing is billed while you are still deciding. A complete listing of what came off the drive reaches you first, and the invoice only follows your yes. Files travel back on media bought new for the job, return postage ours, and we do not close it here until every one of them opens on the machine you will use.
To put it plainly: if the 48 digits are gone, the volume stays shut, permanently. That is Microsoft's line and it is ours too, because encryption a lab could talk its way around would be worth nothing to anybody. So the first move is a search, not a strip-down — the home account, the work account, the escrow your IT team keeps, a folded printout at the back of a ring binder. Turn up the key and the files almost always come with it. If it genuinely exists nowhere, no honest firm can open that disk, and you will hear that from us at the free diagnosis rather than on an invoice.
The recovery key had never been kept by anyone at the practice, and the workstation booted asking for it: a firmware update overnight had changed what the TPM was measuring beneath. Its Recovery Key ID was already sitting in the firm's Entra ID escrow. With that, repair-bde laid sound BitLocker metadata onto a fresh disk, and not one project file was lost.
Start with the eight-character Recovery Key ID on screen, because it names the key the volume will take. On a home machine it was most likely saved to the Microsoft account that set Windows up: aka.ms/myrecoverykey. On a work laptop try aka.ms/aadrecoverykey, then ask whoever runs Intune or AD. Last, the printed sheet in a drawer.
Yes. Microsoft has no back door and neither do we: a sealed volume without its key is encryption doing exactly the job it was bought for. Where these do come good, a key has survived somewhere and the actual fault turns out to be a failing disk or damaged metadata.
Because the TPM checks the machine booting now against the measurements it took at setup, and something no longer matches. A BIOS update, a Secure Boot setting, a replacement motherboard, or the disk moved into a different computer is enough on its own. In July 2024 a Windows update tripped whole fleets at once.
Hardware first. We take a full sector image with the lock still in place, and the key goes onto that image rather than the original. Decrypting means reading every sector in one pass, and a tired mechanism should not be asked to do that.
A failing drive has only so many starts left in it. Spend none of them. Keep the power off, and the free diagnosis will tell you what is still readable.