Encryption · honest limits · ADR-2025-2880
It Asked for a Key He Had Never Kept.
One morning the Dell Precision stopped at a screen it had never shown before. It is requesting a BitLocker recovery key
, he wrote, and by then he had already done the sensible part of the work: through the Microsoft accounts, through the USB sticks, and still he cannot find the key anywhere
. What he wanted to know was whether the files could be reached without it. That answer is short, and he had it before anything was posted.
Same story on yours? Tell us what it does — the look is free.
0203 0868633
What failed, and why.
BitLocker is sound encryption, and that is most of the answer. No method here or anywhere reads a volume without its recovery key or its password; if one existed, the protection would be worthless to every owner it currently defends. So the question stops being how to get past it and becomes where the key is kept. Windows escrows one in a small number of predictable places: a Microsoft account, personal or work-or-school; a page it insisted on printing when encryption was switched on; a file saved to a USB stick; or, on a managed machine, the records of whoever manages it. Worth knowing too is that the prompt is not always a lock. A developing hardware fault can raise it, which is why the drive's own condition gets measured before anyone concludes anything. Working out which of the two applies costs nothing.
What the bench did with it.
The order of the job →| Equipment used | Its work on this job | The reason for it |
|---|---|---|
| Atola Insight Forensic | Cloned before anything else, behind hardware write protection, with each step of it logged | Several images at once behind a hardware write blocker, with every step logged |
| PC-3000 SSD | Established that the volume was encrypted rather than damaged, and measured the drive's condition | Asks the controller itself, rather than accepting whatever an operating system chooses to report |
| UFS Explorer Professional Recovery | Held the clone ready, and read the volume straight out of it once a valid key was entered | Opens APFS, ReFS, XFS, ZFS and Btrfs when other software will not |
What the bench did with it.
Copy it first; discuss the lock afterwards
Nothing was typed at that prompt here. The drive came out, went behind a hardware write blocker and was cloned, and the original was not written to again. Two things follow from working in that order. The module can be put back on the table in the condition it arrived in, whoever later asks about it. And where the question never arises, the precaution has cost nobody anything.
Find out what the prompt is really for
A recovery-key screen is not proof that a drive is well. Windows raises the same prompt when the hardware underneath it changes or starts to fail, so the drive's condition was measured before a word was said about keys. It read cleanly and behaved consistently, which ruled out a whole class of trouble and left exactly one obstacle standing. That obstacle was the encryption, and the encryption is not ours to argue with.
Then look in every place a key is escrowed
BitLocker names the key it wants, so the identifier was read out to him and he was pointed past the two places he had been through already. Microsoft accounts and USB sticks he had covered. What remained were any work or school account the machine had ever been signed into, any file or printed page kept from the day encryption was switched on, and, if the Precision had ever been managed by an employer, the people who managed it. Had none of those held it, the answer would have been no, in those words.
What went home.
The key came back from one of those places, the clone opened, and the contents went home on fresh media. Nothing was charged while the search was going on, and nothing would have been charged had it come to nothing. He was told that at the start, because on this fault the honest position and the commercial one are the same sentence.
Begin here if yours is doing the same thing.
Jobs that came to nothing.
Yours doing something similar? Power it down first.
Prices are published and fixed. Memory cards and USB sticks are priced at £250 + VAT. A drive on its own comes to £300 + VAT. Anything holding a second disk, whether RAID, NAS or a server, opens at £500 + VAT. The first look costs nothing, and the figure that follows is fixed and in writing before a penny is charged. Switch it off and post it in. Most jobs carry no fee where no files return.