Open, and work is coming in · weekdays, 9am–5:30pm Faster by phone: 0800 6890668
PDR Plymouth Data Recovery 0800 6890668 Get a price
PDR / Everyday faults / BitLocker wants the key

The fault · BitLocker and TPM lockouts

BitLocker recovery for Plymouth. The disk itself is working; only its key has gone.

A PC sitting at the 48-digit prompt will normally have nothing wrong with it. When the drive was encrypted, the TPM recorded how your machine and boot process looked at that point. One of those details has now changed (new firmware, a Secure Boot setting, a board swap) and the TPM will not release the key until those digits are entered. The disk underneath is usually fine. Most arrive as drives out of managed work laptops, from a Plymouth practice at Sutton Harbour or a supplier's office out at Derriford, encrypted by policy. So the work typically starts with signing in rather than with screwdrivers.

Nothing readable? Most jobs carry no bill Free diagnosis, then one written price Boxes come to the lab from Truro, Newquay and Tavistock

You will be talking to an engineer
0800 6890668

BitLocker: what each symptom points to.

Yours not here? Start at the triage →
The behaviourWhat that points toWhere to start
A blue recovery screen where Windows should beThe TPM sees that the machine no longer looks as it did when it took its measurements, so it keeps the key locked awayGo looking for the key. Never guess it.
The line about using the number keys or F1-F10That line only tells you how to enter digitsDigits alone. A Windows password will not help.
Recovery key ID (to identify your key):Eight characters naming the key this volume needsMatch that ID against each escrow
For more information go to: aka.ms/recoverykeyfaqMicrosoft's own explanation of itMost keys are sitting in an account
BitLocker waiting for activationSwitched on for the volume but never actually runNothing is encrypted at all. It reads openly.
A dying disk with a sealed partition on itHardware first, then the hunt for the keyImage it sealed, then open that copy
Shipping to us: once you receive your quote, pack it securely so it won't move in transit, get it insured for what it is worth, and send it by tracked post to our intake lab in Bristol. We pay the postage back to you. Please contact us before sending if you would like an engineer to check the packing before the box is sealed. More detailed instructions on sending your item to us can be found on our contact page.

The four places to look first.

The Microsoft accountSign in at aka.ms/myrecoverykey in any web browser, even on a mobile phone. Home computers often quietly store their keys there during setup without telling anyone.
A work or study accountSign in at aka.ms/aadrecoverykey using the account issued by your work or college. Laptops under management upload their key to Entra ID on their own, unprompted.
Whoever handles ITCompany machines escrow to Intune or Active Directory. Give whoever picks up the Recovery Key ID, and finding the matching key usually only takes minutes.
A sheet, a text file, a stickA BitLockerRecoveryKey…TXT file stored away in some folder nobody looks in, or the page Windows prompted you to print as it encrypted. These turn up far more often than most people expect.

What happens to a drive while it is here.

Cases in the log →
01

A number on arrival, then the free diagnosis Free

Whatever is delivered is booked in using a unique reference (case number) on the date it arrives at the bench. The engineer will identify the actual fault at no charge. This gives a straightforward answer on what can be recovered from the drive and what cannot, plus one written quotation. There will be no further activity until you have read and accepted the quotation.

Diagnosis at no chargeA single written figureYou owe nothing yet
02

Start by finding the key

Everything hinges on the eight characters displayed above the prompt: they identify the single key that will open this volume. Then comes a list to work through: whatever Microsoft account was first used to sign in to the computer, any log-in provided by your work or college, anything the IT team holds in Entra ID or Active Directory, and the page somebody printed on the day. If no key survives, nobody will be able to unlock the drive, ourselves included.

Key ID identifiedEvery escrow searched
03

Image it still sealed

Where the drive is failing, the sector copy is made with the encryption left exactly as it is, so the worn mechanism is spared a full decryption run. All of the rest happens on the copy.

Imaged with the lock onNothing further asked of it
04

Open the copy, then mend it

Once a key is found, the image opens. If BitLocker's own metadata is damaged too, repair-bde (a Microsoft tool) writes the volume onto new media, and what is recovered goes back to you on new storage bought for the purpose.

repair-bde on the imageWritten to fresh media
05

You give the word, and it ships back

Give yourself time to consider it. It costs you nothing. We list all of the files we recover for you before sending out an invoice, and we only ask for payment once you have authorised it. We also buy media specifically for your recovery and send it back to you, with the return postage paid by us. The case stays here on our bench until we have your confirmation that the files open properly on your own machine.

You see the list and decideWritten to fresh mediaWe pay the postage home

The faults we see most

  • The ID and the key are different: the eight-character ID simply labels the 48-digit string the volume is waiting for. Typed into the box alone, nothing will happen. Give it to whoever manages your IT and they can look up the key.
  • Think back to July 2024: that month a Windows update left entire fleets of computers stuck at the recovery prompt. Then, a couple of weeks later, the CrowdStrike failure hit 8.5 million computers, on Microsoft's figure. Many companies realised then that no key had been escrowed by anyone.
  • Damaged metadata can still be worked with: repair-bde can rebuild a damaged BitLocker volume onto new media. It will not, however, create or retrieve the key; that stays your side of the job.
  • Sealed and failing? Make an image first: decrypting makes the heads read every single sector non-stop until it finishes, and a worn drive is exactly what won't survive that.

Bottom line: lose the 48-digit key and the volume is shut permanently. Microsoft clearly says so, and so do we, because if a lab could get around encryption, there would be no reason to buy it. So the first move is a search rather than a teardown: the home account, the company account, whatever is stored in an IT escrow, a page printed and placed in a file. Find it and the data nearly always follows. Where there is nothing to find, no reputable lab can unlock the disk, and you are told so during the free diagnosis instead of reading it on a bill.

A job out of the casebook.

PL · PLY-2026-0642FILED ✓

A Newquay practice locked out of its workstation by an update that ran overnight

The key existed. The people at the practice did not know that. An overnight update had changed what the TPM measured, so when the workstation started it wanted a key none of the staff had recorded anywhere. Its Recovery Key ID matched an entry already held in the firm's Entra ID escrow, and that was enough to solve the problem. repair-bde then wrote fresh BitLocker metadata to a new disk, and the project files opened as before.

100% read back3 days start to finish

Before you seal the box.

Get these done

  • Write down all eight characters of the Key ID
  • Try aka.ms/myrecoverykey, then aka.ms/aadrecoverykey
  • Call IT: a managed device escrows to Intune or to AD
  • Search for the saved .TXT file or the setup printout

What to avoid

  • Guessing at digits
  • Reinstalling Windows to clear the prompt: all the files go with it
  • Typing the eight-character ID into the key box
  • Formatting the drive because you assume it is gone

Questions that come up most weeks.

Where would the recovery key actually be?

Start at the eight-character Recovery Key ID above the prompt: that label tells you which key your volume will take. Most home computers have the key stored in the Microsoft account that set Windows up; check aka.ms/myrecoverykey. Company laptops go to aka.ms/aadrecoverykey, and failing that, ask the person who manages Intune or AD. Then look for the paper copy in someone's desk drawer.

If no key exists anywhere, is that the end?

Yes. There isn't a back door at Microsoft, nor one in this lab. A volume sealed with the key gone is encryption doing exactly the job it was sold to do. The ones that end well are those where the key turned up somewhere, and the real problem was a worn disk or damaged metadata.

Why has it started demanding a key now?

The TPM compares the machine that is booting against what it recorded when the volume was first encrypted, and now they don't agree. A firmware update alone can cause it. So can a change to Secure Boot, a new motherboard, or taking the disk and putting it into a different machine. In July 2024, a Windows update put entire fleets of computers at the prompt.

It is sealed and the disk is dying. What comes first?

Hardware. The sector image is made before anything is unlocked, and the key is used against that image, never against the original disk. A decryption run must read every single sector on the disk without stopping, and a mechanism as worn as this is unlikely to survive it.

Pages people open after this.

Windows machines → Solid-state and NVMe drives → The PC cannot see it → All the media we take →

A drive that stays switched off gets no worse.

Diagnosis costs nothing. We give you a report listing which files can be read, which cannot, and what is needed to get them off. Do not connect the drive until then.

0800 6890668

Book a free look Sending it in to us