Encryption · honest limits · ADR-2025-2880
It Asked for a Key He Had Never Kept.
One morning his Dell Precision stopped at a screen he had never seen before. It is requesting a BitLocker recovery key
, he noted; and, at that time, he had done all that was reasonable for someone who wanted to get the files off the device: going through the Microsoft accounts, going through the USB drives, and still he cannot find the key anywhere
. What he wished to know was whether he could access the files without it. The answer to that was brief, and he had it before anything was posted.
Same story on yours? Tell us what it does — the look is free.
0203 0868633
What failed, and why.
BitLocker is good, sound encryption. This answers most of your question. There is no method available, here or anywhere, that will allow us to read a volume without entering either the volume's recovery key or its password. If such a method existed, the security provided by BitLocker to each owner it protects would be useless. Therefore, the question is no longer "how do I bypass" BitLocker but "where did I keep my recovery key?" Windows keeps the recovery key in a limited number of predictable locations: within a Microsoft account (personal or work/school); on a paper printout created by Windows when you enabled encryption; in a file on a USB flash drive; or on a managed machine, in the record of the person managing the machine. Also worth noting is that the prompt does not always indicate an encryption lock. An emerging hardware fault may generate the prompt as well. For this reason, prior to reaching any conclusions regarding what failed, both the volume's integrity and the drive's health are evaluated at no charge.
What the bench did with it.
The order of the job →| Equipment used | Its work on this job | The reason for it |
|---|---|---|
| Atola Insight Forensic | Cloned immediately, behind a hardware write protector, with each action taken logged | Multiple images created simultaneously behind a hardware write blocker, with each step documented |
| PC-3000 SSD | Determined that the volume was encrypted rather than damaged. Evaluated the condition of the drive | Asks the physical controller itself, rather than trusting whatever the OS reports |
| UFS Explorer Professional Recovery | Kept the clone set aside, and accessed the volume directly from the clone after entering a valid key | When other applications will not open it, this application will open APFS, ReFS, XFS, ZFS and Btrfs. |
What the bench did with it.
Copy it first; discuss the lock afterwards
No input was made at that prompt. The drive was removed from service and placed behind a hardware write blocker. A clone was produced, and the original drive was not modified again. From this sequence of events, two additional benefits arose. In the event that someone asks about it later, the module can be put back on the table in the exact state it was delivered. In addition, where the possibility of needing to ask about it never arises, the precaution results in no expense to anyone.
Find out what the prompt is really for
The display of a recovery-key prompt does not imply that a particular drive is healthy. Windows generates the same prompt whenever the underlying hardware supporting it changes or begins failing, therefore we first determined the health of the drive before making reference to keys. It was cleanly readable and consistent in operation, which eliminated a large category of potential problems, leaving only one remaining obstacle: the encryption. We have no control over or argument with respect to the encryption.
Then look in every place a key is escrowed
BitLocker identifies its desired recovery key, and thus we read the ID out to him and directed him past the areas he had previously visited, namely Microsoft accounts and USB sticks. Given that these two methods had been addressed, what remained to be checked were: any previous work or school account under which this machine had ever authenticated; any file or paper printout generated during the process of enabling encryption; and, if this Precision had previously been administered by an employer, any personnel involved in administering it. If none of these had retained it, our answer would have been no, in those words.
What went home.
The key showed up from one of these locations, and we opened the clone and transferred the recovered contents home onto new media. No charges were incurred while the search was going on, and in most cases you only pay if we recover your data. He was told that at the beginning, because on this fault there is no difference between the honest position and the commercial one: both are the same sentence.
Begin here if yours is doing the same thing.
Jobs that came to nothing.
Yours doing something similar? Power it down first.
Published prices are fixed. Memory cards and USB sticks are £250 + VAT. Any stand-alone drive is £300 + VAT. Drive configurations containing multiple disks (RAID, NAS or server) start at £500 + VAT. First assessments are always complimentary. Thereafter, data recovery charges are also fixed in advance and in writing, so you'll always know how much you owe before paying any money. Shut it down, get a quote first (by phone or with the form), then send it in or drop it off at our Guildford intake laboratory, Monday to Friday, 9am to 5:30pm (no appointment needed). On most jobs you only pay if we recover your data.