Cause of loss · BitLocker & TPM lockouts
When a PC stops at the 48-digit prompt, nothing has broken. The TPM took a measurement of the machine at setup, the machine no longer matches it — new firmware, a boot setting changed, a board replaced — and the chip holds onto the key until the recovery key goes in. The platters are usually fine. That is why the first hour of a case like this goes on accounts rather than tools.
Tell an engineer what it is doing
0800 6890668
| Symptoms | What is behind it | What to do |
|---|---|---|
| The boot screen asking you to enter the recovery key for this drive | Boot measurements have changed, so the TPM will not release the key | Go and find the key; do not guess |
| Use the number keys or function keys F1-F10 (use F10 for 0). | It is telling you how to type the 48 digits | Digits only; a Windows password is no use |
| Recovery key ID (to identify your key): | Eight characters saying which of your keys this volume expects | Look the ID up in the escrows |
| For more information go to: aka.ms/recoverykeyfaq | Microsoft's own guidance page | Your account is where the key sits |
| BitLocker waiting for activation | Encryption has been set up on it but never actually run | Open to anyone; no protection at all |
| A locked volume on hardware that is dying | Deal with the drive, then the key | Copy it locked; unlock the copy |
Every item gets a case number of its own the day it lands. An engineer then works out what has actually failed and tells you plainly which files have a real chance of coming back and which do not. Only then does a price follow: one figure, fixed, in writing, and it costs you nothing to see it. Nothing is charged until you say yes.
Everything hangs on the eight characters shown above the prompt, because they say which key this volume will accept. From there it is a list to work through: the personal Microsoft account behind the machine, a work or university sign-in, the escrow IT keeps in Entra ID or Active Directory, and the sheet printed on the day. Without a key there is nothing, for us or anyone else.
If the drive is on its way out, we image every sector with the lock still on, so a weakening mechanism is never asked to sit through a decryption pass.
Once the key turns up, the image opens. If the BitLocker metadata is damaged too, Microsoft's own repair-bde puts the volume back together on separate media, and the files leave on a fresh disk.
No invoice is raised until the full list of recovered files has sat in front of you and you have said go ahead. Your data comes back on media we buy new, posted at our expense, and the job is not closed here until every file has opened on your own machine.
Plainly, then: lose the 48 digits and that volume stays shut for good. It is Microsoft's position and it is ours, because encryption a laboratory could argue its way past would protect nothing. So the opening move is searching rather than engineering — the home sign-in, the work sign-in, the escrow the IT team keeps, a sheet of paper folded into the back of a ring binder. Find the key and the files nearly always come with it. If it truly no longer exists anywhere, nobody honest can open that volume, and we will tell you so at the free diagnosis rather than after billing you.
The workstation came up demanding a recovery key that nobody in the practice had kept, an overnight firmware update having moved the TPM measurements beneath it. Its Recovery Key ID matched an entry in the practice's Entra ID escrow, and from there repair-bde put the damaged BitLocker metadata back onto a clean disk. Every project file came through.
Read off the eight-character Recovery Key ID first: it tells you which key the disk is asking for. A personal machine usually parked its key in the Microsoft account used to set it up — aka.ms/myrecoverykey. A company laptop goes to aka.ms/aadrecoverykey, or to whoever runs Intune or Active Directory. Then check the drawer for a printed sheet.
It is. Microsoft cannot get past it either, and neither can we — a sealed volume with no key is encryption working as intended. The jobs that come good are the ones where a key does still exist somewhere and what has actually gone wrong is hardware or metadata.
The TPM compares the machine it measured at setup against the one booting now, and something has moved. A firmware update, a Secure Boot change, a board swap, or the drive being lifted into another computer will all do it. A Windows update in July 2024 did it to thousands at once.
With the hardware. The whole volume is imaged while it is still sealed, and the key is applied to that image, not to the drive. Decryption reads the disk end to end, which is the last thing a dying one should be doing.
Every extra power-up takes something off a drive that is already going. Leave it switched off and let the free diagnosis say what still reads.