Job log · Where the limit falls · RDG-2025-1480
The Scanner No Longer Knew Her Own Thumb.
Payroll week at her practice in Reading, four clients waiting, eight years of other people's accounts
on the drive — and a laptop that had locked her out after four wrong attempts. Her thumb had opened that ProBook since the day she set it up; then an update removed the option — there is no fingerprint box on the login screen any more
— leaving her with a PIN chosen one afternoon eight years earlier and never typed since. After the first day the reader just did it for me.
Same fault on yours? Tell us what it is doing.
0800 6890668
What actually caused it.
Which of the two you have is a five-minute question, and it costs nothing to answer, so it is answered first: the module comes out and goes onto bench hardware. One answer is an afternoon's work. The other is a wall, and it is a wall to this lab as much as to you. The account password is the easy one. It fences off a Windows account and nothing beneath it, so the sectors themselves never knew about it — which is why the sign-in screen that had held her up all week became irrelevant the moment the flash was addressed on its own. BitLocker is the wall. It encrypts the volume from first sector to last, and without either the key or a recovery password to stand in for it, what lifts off the chips is noise.
What this one needed on the bench.
How every job runs →| Bench tools | Its part in this job | Why it is here |
|---|---|---|
| Atola Insight Forensic | Cloned the module behind a hardware write blocker, before keys were even discussed | Several images at once from behind a write blocker, with every action logged |
| PC-3000 SSD | Confirmed the flash itself was sound — the obstacle was the encryption, not the hardware | Interrogates the controller itself, rather than trusting what the operating system reports |
| UFS Explorer Professional Recovery | The plain volume mounted straight away; the encrypted one sat until the key turned up | Opens volumes other tools refuse: APFS, ReFS, XFS, ZFS and Btrfs |
What the bench did.
Copy it before the lock screen appears
Step one on that ProBook was to lift the NVMe out and clone it behind a hardware write blocker. Nothing after that touched the original. Two benefits follow. Ownership of the machine, or the question of what this bench did to it, can be settled later by producing the module exactly as it came in. And if the question never arises, the precaution cost nothing.
Check the headers before quoting a figure
Headers gave the answer inside a minute. Volume one was plain NTFS with the operating system on it, and read straight off the copy, the sign-in that had stopped her for a week counted for nothing whatever. Volume two carried the accounts, with a BitLocker signature sitting over them. A checklist from her professional body had prompted her to switch encryption on some years back; she had not thought about it since. Both volumes were priced in the written quote.
Look for the printed key before conceding anything
A BitLocker volume announces which key it is waiting for, so the identifier went to her over the phone. Nothing resembling it had ever reached her, she was sure. Then it came back to her: Windows had once insisted she print a page whose purpose she had not grasped at the time. She read the identifier back to us from a ring binder at home, filed behind her practising certificate, and the volume opened straight away. Throw that page out and the answer is no, and she would have had it in those words.
What went back.
Two volumes went home with her. The system side showed no sign that any lock had stood over it; the accounts opened to a sheet of paper printed years earlier and never once looked at since. Fresh media carried the payroll out, forty-eight hours later than it should have gone. Three separate places hold that recovery key now. None of them is the laptop.
If this sounds like yours, start here.
Jobs where the answer was no.
If that sounds like yours, stop there.
Post it in as it is, switched off. Looking costs nothing, and you get one fixed figure in writing before any chargeable work begins — £250 + VAT for a card or stick, £300 + VAT for a single drive, from £500 + VAT for RAID and NAS. On most jobs, nothing is charged unless your data comes back.