Taking work now — the first look is freeSpinning disks in a machine Quicker still, give us a ring:0203 0868633
ADR Advanced Data Recovery 0203 0868633 Price my job
ADR / Sorted by symptom / No BitLocker recovery key

The fault · a TPM, a prompt and 48 digits

BitLocker recovery, London. Eight characters, not forty-eight. They name the one key.

Nine times out of ten a machine sits at the recovery key prompt and is perfectly fine. When you enable encryption, the trusted platform module (TPM) records measurements of the motherboard and the boot path. If anything in either changes (the firmware is updated, Secure Boot is set differently, the motherboard is changed), the TPM will refuse to hand over what it holds until you enter the correct digits. This is therefore a task centred around sign-ins rather than screwdrivers. It starts with finding the Recovery key ID displayed on screen, because that string of eight characters identifies a specific key and turns a hunt into a list of four locations. Most of our work involves recovering files from drives out of managed company laptops from throughout London, with a consistent amount coming from Canary Wharf, where media is encrypted as standard practice and the recovery process must be acceptable to both the compliance officer and the owner. For a single drive, the cost is £300 + VAT. There is no charge for the assessment, and in most cases you only pay if we recover your data.

Only pay if we recover your data, on most jobs A free look first, then one figure in writing Media posted in from Croydon, Ealing and Camden

Put it to an engineer — the first look costs nothing
0203 0868633

BitLocker: what the symptom usually means.

Different fault? Try the finder →
How it shows itselfThe usual reason for itWhere that leaves you
A blue BitLocker screen instead of WindowsWhat the TPM measured has been modified, so now it won't give you the keyFind the key; guessing gets you nowhere
This note regarding number keys and F1 to F10That is all keyboard advice and nothing elseIt's digits only. A Windows password won't help you
The Recovery key ID (eight characters long)The reference name of the single key that the volume will acceptGo around each escrow in turn using that reference
The link at the bottom, aka.ms/recoverykeyfaqMicrosoft explaining its own screenTypically your account already has the key sitting in it
Note: BitLocker is waiting to be activatedEnabled on the volume, though encryption never ranNothing is encrypted so it opens as it always did
Locked volume on a disk that is failingHardware first, with the key search running side by sideCopy the locked drive, then unlock the copy
Packing it and posting it: get a quotation first (either via the telephone or with our online form), then make certain it is adequately padded so that it does not move around when it travels, and post it tracked and insured to our Guildford intake lab, or take it directly to us there, Monday to Friday, 9am to 5:30pm (no appointment needed). We cover the postage costs for the trip home. Would you prefer to discuss packing the item with one of our engineers prior to sealing the package? Please call us. All aspects of how to pack and post it are detailed within the guide to packing and posting.

The four places that key gets filed.

The home Microsoft accountAccessible from any browser, including a phone's: aka.ms/myrecoverykey. A home PC saves its key to that Microsoft account during setup without mentioning it, and then Windows says nothing about it afterwards.
A work or college log-inaka.ms/aadrecoverykey, using the sign-in provided to you by an employer or college. A managed laptop automatically sends the key up to Entra ID without being asked.
Whoever administers your ITCompany machine keys are stored in either Intune or Active Directory. Provide the Key ID to whoever manages one of those systems and the answer usually comes back within a couple of minutes.
Paper, a text file, a stickA BitLockerRecoveryKey…TXT file located in a folder nobody has opened since, or the sheet Windows offered to print while encryption ran. Both surface more often than anyone would expect.

From the box arriving to your files going back.

Work we have closed →
01

Logged the day it lands, and the first look costs nothing Free

As soon as your parcel arrives here, an engineer assigns a case number that same day, prior to determining what has really failed, which is the first thing done and costs you nothing. In addition to a note of what can and cannot be recovered from your drive, you will receive at the same time the fixed, written price for restoring what can be recovered. You can accept this quote, or decline it, which will result in no further obligation on your part and nothing owed to us.

Nothing to pay for lookingA single figure, put in writingNothing owed at this stage
02

Finding the key comes before anything else

There can only be one key used to access this volume, and the screen indicates which one it is. Therefore, what follows is a short list rather than a hunt: which Microsoft account initially signed into the PC? Is there an employer or college log-in? Was the computer ever registered by an IT team, in Entra ID or Active Directory? And did anyone print that sheet while encryption was being enabled? Every one of these four gets worked through, and where every answer comes back no, this laboratory is shut out just like you are, which you hear while the assessment is still free.

The eight-character ID notedEach escrow tried in turn
03

Imaged with the lock in place

Disk failure alters the order of work but nothing more than that. Imaging is done with the lock still applied, which protects the mechanism from a decryption pass it will likely not see out, and every step afterwards is run against the image.

Copied while still lockedThe disk is asked for no more
04

The copy opened, then mended

Once the key shows up, the image is accessed with it. Should BitLocker's own structures have been damaged too, repair-bde (a Microsoft utility, not somebody's third-party guess) reconstructs the volume onto fresh media supplied with the job, and that is what goes home.

repair-bde used on the imageFresh media, supplied with the job
05

You see the file list before you pay

You will see what has been recovered as a list first, after which a bill exists. Accepting the list means that a bill will be issued. Rejecting the list means that a bill will not be issued, and in most cases you only pay if we recover your data. The recovered data travels from here back to you via new media purchased specifically for your project, with the cost of postage paid by us. Your case is not resolved (i.e., "closed") until you personally view the files on a computer of your own.

No charge until you accept the figureFresh media, supplied with the jobThe post home is ours

What arrives most often

  • An ID isn't a key: those eight characters simply point to the 48 digits, which is why the box rejects them regardless of how carefully they were entered. Give the reference to the person who manages your IT, and looking it up rarely takes long.
  • July 2024 is the example used for demonstration purposes: a faulty security update stopped approximately 8.5 million Windows-based computers worldwide, according to Microsoft's official estimate, and beginning the process of correcting the issue required someone producing each computer's BitLocker key. Many businesses found in July 2024 that nobody had ever escrowed any of their BitLocker keys.
  • Damage to metadata is not the end: if the damage is in BitLocker's own data structures, then repair-bde can restore the volume to another piece of media. No utility will provide the key; that half of the job still belongs to you.
  • Struggling and locked? Make a copy first: decryption requires one single complete pass from start to finish on the disk, so if your drive was failing, it would be the exact one that stopped part-way through.

Put plainly: it goes without saying that there is no volume without the 48 numbers. Microsoft said so, too, and this lab does as well, for the obvious reason: if a laboratory could decrypt it from the outside, the encryption would never have been worth paying for. Therefore, instead of tearing down the device, the work begins by searching for the key among four possible locations: a home account, an employer's account, whatever IT placed in escrow, and the sheet somebody filed away. Once one is found, the associated files usually follow. If none is found, no legitimate lab anywhere will open that device, and you will know this while your assessment is still free, instead of waiting two weeks for an invoice to arrive.

One job, followed all the way through.

LDN · ADR-2026-3192JOB LOGGED ✓

An overnight update shut a Westminster practice out of its own workstation

The practice had an internal recovery key all along and did not know it. An overnight update had changed the TPM measurements, and the workstation prompted at boot for a 48-digit code that was never recorded. The Recovery Key ID appeared on the screen, and it matched an escrow record the firm already held in Entra ID, which answered the job. The repair-bde tool created fresh BitLocker metadata on a replacement disk. All project files were able to open as normal.

100% of them recovered3 days here, and back to you

What helps, and what harms.

Do this much first

  • Write down the Key ID exactly, all eight characters
  • aka.ms/myrecoverykey first, then aka.ms/aadrecoverykey
  • Ask IT: managed machines escrow their keys into either Intune or Active Directory
  • Look for the printout in the desk drawer, and for the .TXT file on the disk

What sets us back

  • Trying to guess the 48-digit code
  • Installing Windows again to remove the prompt, files and all
  • Typing the eight-character ID into the key box
  • Formatting it, assuming that the data has vanished

Questions answered before you commit.

Where does BitLocker file the recovery key?

You need to look in four places, and can narrow down to a single key prior to starting. The Recovery key ID listed above the box consists of eight characters and is associated with only one volume. On home PCs, aka.ms/myrecoverykey should come first, logged in using the Microsoft account used initially to set up that particular PC. On company laptops, aka.ms/aadrecoverykey should be attempted, then the administrator of either Intune or Active Directory. Finally, the fourth option is whatever Windows printed out when encryption was first enabled on that particular volume.

Nobody wrote the key down anywhere. Now what?

At which point it stays shut, and that is what the product does best. Neither Microsoft nor this laboratory will ever breach it. Successful jobs are the other type: where indeed a backup of the key survived somewhere and the real failure is with worn hardware or metadata requiring reassembly.

Why is it asking now, after years?

Since the machine's boot-time measurement no longer matches what it recorded when encryption was first enabled. A firmware update will cause this unprompted. Likewise, so will a changed Secure Boot setting, a new motherboard being installed, or a drive being inserted into another machine. July 2024 was everyone's go-to example, when a bad security update stopped Windows computers world-wide and every fix began with someone entering 48 digits.

A failing disk and a locked volume — which first?

Hardware, then keys. A copy of the volume is made while it is still locked, and the key is applied to that copy, not the original. Decrypting in place requires one complete, unbroken pass across the entire surface of the media, and worn mechanical parts are almost certainly one of the least likely things here to allow such a process.

Begin here if yours is doing the same thing.

Desktop PCs and laptops → NVMe and SSD at chip level → Nothing detects the disk → Every device we take →

Nothing gets worse while the power is off.

It doesn't cost you anything for us to look at it. All we do is give you a breakdown of what opened and what did not, plus a single fixed price to complete, written down before you agree to let us continue. On most jobs, you only pay if we recover your data. Please don't turn on the drive until you get that breakdown.

0203 0868633

Get it assessed Sending it to Guildford