Taking work now — the first look is freeSpinning disks in a machine Quicker still, give us a ring:0203 0868633
ADR Advanced Data Recovery 0203 0868633 Price my job
ADR / Sorted by symptom / No BitLocker recovery key

The fault · a TPM, a prompt and 48 digits

BitLocker recovery, London. Eight characters, not forty-eight. They name the one key.

Nine machines in ten sitting at that prompt have nothing whatever wrong with them. Turning encryption on had the TPM record a measurement of the board and of the boot path; disturb any part of it — new firmware, a Secure Boot setting, a replaced mainboard — and the chip will not hand over what it holds until the digits are typed. Which makes this a job about sign-ins rather than screwdrivers, and it begins with the Recovery key ID on screen, since those eight characters identify a single key and turn a hunt into a list of four places. Most of the work is managed company laptops from across London, with a steady share from Canary Wharf, where media is encrypted as policy and a recovery has to satisfy a compliance officer as well as an owner. A single drive is priced at £300 + VAT, nothing is charged for the assessment, and on most jobs an invoice arrives only where data does.

On most jobs: no data, no bill A free look first, then one figure in writing Media posted in from Croydon, Ealing and Camden

Put it to an engineer — the first look costs nothing
0203 0868633

BitLocker: what the symptom usually means.

Different fault? Try the finder →
How it shows itselfThe usual reason for itWhere that leaves you
A blue BitLocker screen instead of WindowsWhat the TPM measures has altered, so it withholds the keyGo and find the key; guessing gets nowhere
The note about number keys and F1 to F10Keyboard advice, and nothing beyond thatDigits only. A Windows password is no help
The Recovery key ID, eight characters longA reference naming the single key this volume will acceptTake that reference round each escrow in turn
The aka.ms/recoverykeyfaq link along the bottomMicrosoft explaining its own screenThe key is usually already sitting in an account
A note that BitLocker awaits activationEnabled on the volume, though encryption never ranNothing is encrypted, so it opens as it always did
A locked volume on a disk that is failingHardware first, with the key search running beside itCopy it locked, then unlock the copy
Packing it and posting it:cushion it so nothing can shift about, insure the parcel at the value of the files and not the price of the hardware, and post it tracked. We meet the cost of the leg home. Prefer to walk the packing through with an engineer first, before the box is sealed? Ring us. Every bit of it is written down on theguide to packing and posting.

The four places that key gets filed.

The home Microsoft accountReachable from any browser, a phone's included: aka.ms/myrecoverykey. A home PC escrows its key against that account during setup without announcing it, and Windows says nothing about it afterwards.
A work or college log-inaka.ms/aadrecoverykey, using the sign-in an employer or a college issued you. A managed laptop sends its key up to Entra ID by itself, without being asked.
Whoever administers your ITOn a company machine the key ends up in Intune or in Active Directory. Give the Key ID to whoever administers one of those and the answer usually comes back within a couple of minutes.
Paper, a text file, a stickA BitLockerRecoveryKey…TXT filed in a folder nobody has opened since, or the sheet Windows offered to print as encryption ran. Both of them surface more often than anyone expects.

From the box arriving to your files going back.

Work we have closed →
01

Logged the day it lands, and the first look costs nothing Free

A case number goes on it the day the parcel lands, and an engineer settles what has truly failed before anything else happens — free of charge, and first in the order of work. Back to you come two things together: a straight note of what is liftable and what is not, plus one figure, fixed and written down. Accept it, or decline and owe us nothing.

Nothing to pay for lookingA single figure, put in writingNothing owed at this stage
02

Finding the key comes before anything else

Only one key opens this volume, and the screen says which, so what follows is a short list rather than a hunt. Which Microsoft account originally signed into the PC? Is there an employer or a college log-in? Was the machine ever enrolled by an IT team, into Entra ID or Active Directory? And did anybody print that sheet as encryption was turned on? All four get worked through, and where every answer comes back no, this laboratory is shut out just as you are — which you hear while the assessment is still free.

The eight-character ID notedEach escrow tried in turn
03

Imaged with the lock in place

A disk that is failing alters the order of work and nothing more. Imaging is done with the lock left on, which spares the mechanism a decryption pass it would most likely not see out, and every step from there runs against the image.

Copied while still lockedThe disk is asked for no more
04

The copy opened, then mended

The moment a key turns up, the image is opened with it. Should BitLocker's own structures have been hurt too, repair-bde — a Microsoft utility, not somebody's third-party guess — reconstructs the volume onto fresh media supplied with the job, and that is what goes home.

repair-bde used on the imageFresh media, supplied with the job
05

You see the file list before you pay

What was recovered is listed for you first, and only then does a bill exist. Approve the list and it is invoiced; turn it down and it is not — and where nothing has come back, most jobs carry no charge whatever. Recovered data travels home on fresh media bought in for your job, with the postage at our end. Your case is not closed until you have read those files on a machine of your own.

No charge until you accept the figureFresh media, supplied with the jobThe post home is ours

What arrives most often

  • An ID is not a key — those eight characters merely point at the 48 digits, which is why the box rejects them no matter how carefully they are entered. Give the reference to the person who administers your IT and looking it up rarely takes long.
  • July 2024 is the worked example — a faulty security update stopped Windows machines across the world, some 8.5 million of them on Microsoft's published estimate, and putting each one right began with somebody producing its BitLocker key. Plenty of firms discovered that month that nobody had ever escrowed a key at all.
  • Damaged metadata is not the end — when BitLocker's own structures take damage, repair-bde can put the volume back out onto different media. The one thing no utility does is supply the key itself; that half of the work stays with you.
  • Failing and locked? Copy before unlocking — decryption wants one continuous pass over the entire surface, and a drive that is already struggling is precisely the one that stops half way through it.

Put plainly: without the 48 digits there is no volume. Microsoft says as much and this bench says the same, for the obvious reason — encryption a laboratory could undo from the outside would never have been worth paying for. So the work opens with a search rather than a teardown, across four places: a home account, an employer's account, whatever IT escrowed, and the sheet somebody filed away. Find one and the files usually follow. Find none and no honest firm anywhere is opening that disk — and that verdict reaches you while the assessment is still free, rather than on an invoice a fortnight afterwards.

One job, followed all the way through.

LDN · ADR-2026-3192JOB LOGGED ✓

An overnight update shut a Westminster practice out of its own workstation

The practice had the key all along and did not know it. An overnight update altered the TPM measurements, and the workstation asked at boot for 48 digits nobody had ever noted down. On screen was a Recovery Key ID, and it matched an escrow record the firm already held in Entra ID, which answered the job. Fresh BitLocker metadata went onto a replacement disk using repair-bde, and every project file opened normally again.

100%of them recovered3days here, and back to you

What helps, and what harms.

Do this much first

  • Copy the Key ID down exactly, all eight characters
  • aka.ms/myrecoverykey first, then aka.ms/aadrecoverykey
  • Ask IT: managed machines escrow into Intune or AD
  • Search the drawer for the printout, and the disk for the .TXT

What sets us back

  • Trying to guess the 48 digits
  • Reinstalling Windows to be rid of the prompt, files and all
  • Typing the eight ID characters into the key box
  • Formatting it on the assumption the data has gone

Questions answered before you commit.

Where does BitLocker file the recovery key?

In four places, and you can narrow to a single key before you start. The Recovery key ID above the box runs to eight characters and belongs to that volume alone. On a home PC, aka.ms/myrecoverykey comes first, signed in as whichever Microsoft account originally set that PC up. On a company laptop it is aka.ms/aadrecoverykey, then whoever administers Intune or Active Directory. Last of the four is whatever Windows printed when encryption was first turned on.

Nobody wrote the key down anywhere. Now what?

Then it stays shut, and that is the product doing exactly what it was bought to do. Microsoft cannot get past it and neither can this laboratory. The jobs that end well are the other kind: the key did survive somewhere, and the true fault turns out to be worn hardware, or metadata needing to be put back together.

Why is it asking now, after years?

Because the measurement the machine makes at boot no longer matches the one it recorded when encryption was first switched on. A firmware update will do it unprompted. So will a changed Secure Boot setting, a replaced mainboard, or a disk lifted into some other machine. July 2024 is the example everybody remembers, when a faulty security update stopped Windows machines worldwide and every repair began with somebody typing 48 digits.

A failing disk and a locked volume — which first?

Hardware, then keys. A copy is made while the volume is still locked and the key is applied to that copy, never to the original. Decryption in place calls for one unbroken pass right across the surface, and a worn mechanism is about the last thing here that would see one through.

Begin here if yours is doing the same thing.

Desktop PCs and laptops → NVMe and SSD at chip level → Nothing detects the disk → Every device we take →

Nothing gets worse while the power is off.

Looking at it is free. Back comes a list of what opened and what did not, together with a single price to finish, set down in writing while you are still free to say no. On most jobs an invoice only follows the data. Until that list reaches you, leave the drive switched off.

0203 0868633

Get it assessed Sending it to Guildford