Open, and the first look is free · 9am–5:30pm, Mon to Fri Quicker to ring: 0800 6890668
RDR Reading Data Recovery 0800 6890668 Get it quoted
RDR / By symptom / The BitLocker key is missing

The fault · BitLocker, the TPM and a missing key

BitLocker recovery for Reading. Nothing is wrong with the disk; the key is what went missing.

A machine that sits at the 48-digit prompt is generally a healthy machine. When the volume was encrypted, the TPM measured the board and the boot path; since then something has changed (the firmware, a Secure Boot setting, the motherboard), which is why the TPM will not give up its key until you enter the right digits. So this job begins with sign-in credentials rather than a screwdriver. Most of these machines come from Reading or nearby as managed work laptops: a consultant's laptop in Caversham, an office PC from a Theale warehouse, a lab workstation from Didcot. The look is free, a single drive is £300 + VAT, and you are told within the first day whether a key exists to be found.

Only pay if we recover your data, on most jobs The diagnosis is free; then one fixed figure in writing Parcels arrive from Newbury, Woodley and Theale

An engineer answers, and looking is free
0800 6890668

Match the symptom to the fault.

Different fault? Begin at the triage →
What you noticeWhat is likely wrongWhat happens next
A blue BitLocker screen instead of WindowsThe TPM's checks no longer match, so it won't unseal the keyFind the key. Never guess at it.
The note about the number keys and the F1-F10 keysThat line only shows you how to type in the digitsJust the digits; a Windows logon will do nothing here.
Recovery key ID (to identify your key):The full ID of the one key this volume uses; the first 8 characters of the ID are what every search matches onSearch every escrow for that ID in turn
For more information go to: aka.ms/recoverykeyfaqMicrosoft's own page about the promptAlmost all keys are already waiting in some account
BitLocker waiting for activationThis volume is encrypted, but its key is stored on the disk unprotected, in plain sight, as a clear key; the protection hasn't been activatedThe volume opens as normal. It is encrypted, but it has not been locked.
A failing hard drive with a sealed volume on itHardware first, with the search for the key alongsideCopy it sealed, then unlock the copy
Packing and posting: get a quote first, either by calling us or by using our quote form. When posting it, make sure it is securely packed to prevent movement in transit. The value you put on the parcel should reflect the data, not the hardware, and it should be sent tracked and insured to the Oxford intake lab. Alternatively you can drop it off at the Oxford intake lab Monday to Friday, 9am to 5:30pm, without needing an appointment. We cover the cost of returning it. If you wish to discuss packing before sealing the box, please ring us. All of this is set out on the packing and postage page.

Four places the BitLocker key is usually sitting.

A home Microsoft accountFrom any browser (even on a phone), go to aka.ms/myrecoverykey. A home PC stores its recovery key there during the initial setup of Windows, and you are never told about it.
A workplace or college accountSign in at aka.ms/aadrecoverykey with the login your employer or college provided. Managed laptops store their keys in Entra ID automatically.
Whoever runs the ITCompany computers typically store keys with Intune or Active Directory. Give the administrator your Key ID and they can retrieve the key, in most cases within minutes.
A printout, a text file, a stickEither a BitLockerRecoveryKey…TXT file saved into a folder no one ever opens, or the page Windows asked you to print while the encryption was running. Both turn up more often than expected.

From your parcel to your files coming back.

Jobs we have closed →
01

Logged the day it lands, and the look costs nothing Free

A case number is assigned to your device when we receive it. An engineer then finds the real fault (free) before anything else occurs; you will be advised clearly of what will be returned and what will not, along with a single written price. Charges cannot begin until you have read this and accepted.

The look costs you nothingA fixed price, in writingStill nothing to pay
02

The search for the key comes first

The Key ID listed above the prompt identifies the one key that unlocks this volume (its first eight characters are what each search matches on), and there is a brief list of places where the key might be. A printout someone filed when the system was set up. The Microsoft account that Windows was first logged into. A school or work login. Entra ID or Active Directory, if an IT department has ever managed the computer. Each will be checked. If no key was ever saved, then nobody, this lab included, can get into the volume, and you would know this before spending money.

The Key ID read off the screenEach escrow checked
03

Copied with the encryption left on

A failing disk will alter how the work gets done, but not what gets done. First, we image the volume while it is still locked, to spare the mechanism a decryption pass (which it likely wouldn't finish). Then the rest of the process happens on that image.

Copied with the lock still onNothing more asked of the disk
04

Decrypt the copy, then rebuild it

As soon as a working key turns up, the copy is unlocked. And if, besides being encrypted, some of BitLocker's own metadata is damaged, Microsoft's own tool repair-bde writes the volume out to fresh media, and your files come home on new storage bought specifically for the job.

repair-bde run on the copyNew media, bought for the job
05

The list first, then the bill, then the files

You look at the file list first and make a decision about what to do. We will never invoice anything until you have said yes, and in most cases you only pay if we recover your data. All of the information that we recover will be put on new media purchased by us specifically for this job, and our company pays the cost of postage back to you. The case stays open on the bench until you tell us the files open on your own machine.

Nothing billed until you say yesNew media, bought for the jobPostage home is on us

What goes wrong most often

  • Using the ID does nothing: the Key ID is simply a label for the 48-digit key, so the box will always say no. Hand the first 8 characters to whoever runs your IT instead; from that reference they can typically find the key in minutes.
  • The case study here is July 2024: a Windows update issued on 9 July sent some computers to this prompt, and the CrowdStrike outage ten days later hit approximately 8.5 million Windows machines (a number Microsoft itself released). Many companies learned that month that nobody had stored a backup copy of the key.
  • Damaged metadata does not have to make everything unusable: repair-bde decrypts the data from a damaged BitLocker volume and writes it onto new media, using either the recovery password or the key. If the volume's metadata is damaged as well, repair-bde will need a backup key package in addition to the 48-digit recovery password or key, and that package exists only if it was escrowed. Therefore, the 48 digits alone are not always sufficient. repair-bde does not generate the key. That part remains your responsibility.
  • Sealed and failing? Copy it first: decryption runs the heads over every sector without stopping, and a slow, tired hard drive is very likely to fail before it gets through.

Put plainly: the volume will remain closed without the 48 digits. This is Microsoft's stance and our own, for an obvious reason: encryption that any workshop could get round wouldn't have been worth buying. Therefore, instead of a teardown, our first step here is a search of your accounts and documents: home account, work account, IT escrow, a piece of paper in a binder somewhere. Find one of these and chances are good that your data will follow. Find none and no honest lab in the world can open your disk, which is something you hear during the free diagnosis rather than read on an invoice.

How one of these actually went.

RG · RDG-2026-1792ON FILE ✓

An overnight update, and a Shinfield practice locked out of its own workstation

The recovery key was already available; the practice just didn't realise it. An overnight update changed what the TPM measured, so when the workstation booted up, it asked for 48 digits (the recovery key) which nobody had ever written down. The Recovery Key ID on screen matched an existing escrow record the firm already held in Entra ID, and that was the entire task. repair-bde then took the decrypted contents and wrote them out onto a new disk; all project files opened as they normally did.

100%was recovered3 days from arrival to return

What helps, and what makes it worse.

First things to do

  • Write down the Key ID in full as it is written; only the first 8 characters are needed for the lookup
  • Check aka.ms/myrecoverykey first, then aka.ms/aadrecoverykey
  • Ask your IT department: a managed computer stores its key in Intune or Active Directory
  • Look for the .txt file saved during setup, or the paper printout made at the time

What makes it worse

  • Guessing at the digits
  • Reinstalling Windows so the prompt stops asking (and removing all your files with it)
  • Typing the Key ID into the place where the key should go
  • Formatting the drive on the assumption that it has gone

Answers before you commit to anything.

Where will the recovery key actually be?

Start with the Recovery Key ID shown above the prompt: it identifies the single key used for this volume, and its first 8 characters are what all lookups use to find it. Most home users have had their recovery key saved within whatever Microsoft account they used when setting up Windows; therefore, aka.ms/myrecoverykey is probably your best bet. If you're a work laptop user, your first stop would be aka.ms/aadrecoverykey, followed by the person who manages your Intune or Active Directory (AD). Finally, if none of those options yield a result, check for a printed copy in somebody's drawer.

If nobody kept a key, is that the end of it?

Yes, that is exactly what it was supposed to do. Neither Microsoft nor this lab has a way in, so if you have a locked volume and the key is lost, it will remain locked. What tends to succeed is the other case: a key kept somewhere after all, and a fault which turns out to be a worn disk or broken metadata.

Why is it suddenly demanding a key?

The TPM compares the machine that is booting with what it measured when the volume was encrypted, and something no longer matches. A firmware update alone will trigger it. As will a Secure Boot change, a new motherboard, or putting the disk in a different PC. July 2024 was the month a Windows update sent some devices to the prompt.

It is sealed and the disk is failing. Which comes first?

Hardware, first. The disk is imaged with the volume still locked, so the key is applied to a copy of the data (the image) rather than to the original. Decrypting a volume in place requires every sector to be read once without interruption, and a worn drive is unlikely to manage this.

If this sounds like yours, start here.

Windows PCs and laptops → Solid-state and NVMe → Nothing shows up in Windows → Every device we handle →

Nothing gets worse while it sits switched off.

There is no charge for the look. You then receive a list of the files that opened, those that did not, and a fixed amount to complete the job. Keep it switched off until you have received that in writing.

0800 6890668

Get it looked at Posting it to Oxford