Lab file · Honest limits · BHD-2025-8330
The Reader Has Stopped Knowing My Thumb.
From the day the ProBook arrived her thumb had been the way in. Then an update removed it — the fingerprint symbol has gone off the sign-in screen
— leaving a PIN she had set on day one and not typed since: I put it in once and the reader did the rest
. Four failed guesses and the screen shut her out completely. It was payroll week, four Dudley clients were waiting, and eight years of books that belong to other people
.
Sounds like yours? Give us a ring.
0800 6890668
What that means.
Two different things get called the same thing, and the gap between them decides the whole job. A Windows sign-in screen protects an account and nothing else. It has no claim on the storage — unbolt the module, put it on other hardware, and the screen that beat you for a week was never between you and the sectors. Encryption works the other way round. BitLocker rewrites the volume itself, and without the key, or the recovery password that replaces it, everything you pull off the flash is noise — to us on this bench as much as to anyone else. One of those is an afternoon on the bench. The other is not possible at all. Working out which one you have costs nothing, so it is the first thing done.
What did the work here.
The order of the work →| Equipment | The job it did | What it adds |
|---|---|---|
| Atola Insight Forensic | Made the write-blocked image of the NVMe before anyone mentioned keys | Runs a bank of drives through imaging together, write-blocked and fully logged |
| PC-3000 SSD | Showed the module itself was electrically healthy, so nothing was broken behind the lock | Talks to the flash controller directly, underneath anything an operating system will tell you |
| UFS Explorer Professional Recovery | Mounted the unlocked volume immediately; the other sat waiting on the key | Handles the file systems other tools give up on: APFS, ReFS, XFS, ZFS, Btrfs |
What we did.
Make the image before you argue about locks
The NVMe came out of the chassis first and went straight onto a hardware write blocker to be imaged. That habit pays for itself twice on jobs like this one. If anybody later disputes who owns the laptop, or what we did with it, the original module can be produced exactly as it arrived. If nobody ever asks, the care has cost nothing.
Read both volume headers before quoting a figure
It took a minute at the headers to know where we stood. The system volume was ordinary NTFS, so the sign-in screen that had shut her out for a week meant nothing to a direct read. The other volume, the one with the client ledgers on it, carried a BitLocker signature. She had switched it on years before, working down a list her professional body had sent out, and had not thought about it since. Both were priced in the one written quote.
Go looking for the printout before giving up
BitLocker names the key it wants. That identifier was read down the phone to her. She was certain nothing of the sort had ever been given to her, then remembered Windows nagging her to print a page she had not understood at the time. It was sitting behind her practising certificate in a ring binder. The volume unlocked on the first go. Had that page not existed, this half of the job would have stopped there, and we would have told her so.
How it closed.
Both volumes went back. The system side came off as though there had never been a lock on it; the client side opened to a page printed years earlier that she had never once read. The payroll run went out two days behind, on fresh media. The recovery key now sits in three different places, and the laptop is not one of them.
Other pages worth a look here.
See Where recovery stops.
Is yours behaving the same way?
Switch the device off, post it in, and decide nothing until the diagnosis comes back to tell you where you stand.