When you see a blue screen that requires a 48-digit key you have never seen before, which is preventing you from accessing a drive that contains everything, then we are here for you. We recover BitLocker-locked drives for homes and businesses across Staines and Surrey, finding keys, decrypting estates of drives and rescuing failing disks through their encryption.
Free diagnostic on all jobs recovering data from locked drives using BitLocker. One fixed quote written before any work begins.
In most cases you only pay if we recover your data. For all electronic and mechanical work, including chip-level repairs, 50% is required upfront, with the balance only payable if we recover your data. For BitLocker, ransomware, CCTV/DVR and forensic jobs, full payment is made upfront once you accept the fixed quote. Full details regarding our costs can be found on the data recovery cost page.
Each BitLocker job starts with us looking at the symptoms and matching them to the faults (12 of them) which cover virtually every issue we see on our bench.
Something has changed in either hardware or firmware, or an update has been made, and this has put BitLocker into "recovery" mode. Nothing is lost: essentially, all you need to do is find or recover the missing key.
Usually, the missing key has been stored somewhere along the way, perhaps in a Microsoft or work account, as a file or on a printout; alternatively, it may be retrieved from the TPM or a memory image.
If a volume is password protected, accelerated recovery can provide a rapid solution if the password is weak, and honestly quoted odds if the password is strong.
When you swap motherboards, clear the TPM, update the BIOS or make any changes to Secure Boot settings, the seal is broken and Windows will demand the recovery key for the affected system.
When an encrypted data partition becomes stranded during a reinstall, it will be restored using the key, or via key recovery if no key exists.
The double-trouble case: a failing drive which also contains encrypted data can be copied whilst still locked (using gentle imaging techniques), prior to considering how to decrypt the drive.
USB sticks and external drives are treated exactly the same as drives inside machines when it comes to encryption. All of them open with the correct decryption key, the password or forensic key recovery.
Leavers' machines and retired stock can be decrypted in bulk using whatever keys were escrowed by the organisation.
Removing a drive from its original machine is exactly what BitLocker is designed to notice. This is expected behaviour, and the drive is recoverable with the key.
Damaged encryption headers on an otherwise healthy drive are rebuilt first, and then the volume is decrypted.
A firmware update that clears or reseals the TPM forces the recovery key, which we retrieve from escrow or the TPM state.
A dual-boot install or a GRUB or bootloader update trips BitLocker into recovery; we recover the key and decrypt the volume.
There are two different areas under the umbrella of "BitLocker recovery". Firstly, there is searching out (recovering) keys individuals were never aware they possessed. BitLocker rarely gets switched on without automatically storing a recovery key somewhere: a user's Microsoft account, an organisation's Azure AD/Active Directory, an exported file or even a printed version. Many modern Windows devices encrypt their storage automatically, and save the key during the user's first login. Therefore, most recovery attempts will require a search through all the accounts the device has previously interacted with. Secondly, there is the difficult one: an encrypted drive that is failing.
Business drives and lawful investigations go through the software package known as Passware Kit Forensic, which is the standard most of the industry uses. Passware doesn't break BitLocker: properly implemented, AES (the encryption used in BitLocker) is designed to be unbreakable if you don't know the key, and anyone telling you they can break it is misleading you. What Passware will do is find the key. It can pull it out of a snapshot of the RAM or the hibernation file, get it from the TPM, or try to guess it with a GPU-accelerated dictionary or brute-force attack against the password that protects the volume. In addition to BitLocker and BitLocker To Go volumes, the same tool also opens FileVault, VeraCrypt, TrueCrypt and LUKS volumes. Businesses frequently send us whole estates of drives from leavers and retired machines for bulk decryption against escrowed keys.
The compound case is the situation seen most often from commercial clients: a drive has been encrypted using BitLocker but is now failing (i.e. there are bad sectors in encrypted space), or a laptop crashes into recovery-key purgatory because the disk under it is sick. It's the order of operations that makes all the difference here. The drive is gently imaged in its encrypted state using hardware imaging equipment first, and only then is the decryption process applied using the recovered encryption key. This process should never occur in reverse. Each attempt at unlocking a failing encrypted drive is a read operation that spends the remaining life of the drive, and this is exactly why the honest advice is to stop, obtain a quote over the telephone (0800 689 0668) or use the free online diagnostic tool, and send it to us.
No code breaking is involved in honest BitLocker work. It's simply key recovery plus careful imaging, and the bench equipment is set up to accommodate both processes:
The industry-standard decryption suite: BitLocker keys are retrieved from memory images, hibernation files or the TPM, or the password is recovered using accelerated attack methods. What is retrievable is the key; the AES is never broken.
If the machine still operates, the live encryption key can be captured from the RAM or hibernation file, which is frequently the quickest way into a locked volume.
The attempts made by banks of NVIDIA and AMD GPUs to crack a BitLocker password using dictionaries or brute force run to tens of thousands of guesses per second, backed by rainbow tables.
If a disk containing an encrypted volume fails while still in a locked state, it can be captured in this state behind a write-blocker before doing anything else to it. Once the capture has been done, decryption is performed on this captured version, never on the original.
The process of finding a user's recovery key will take time, but should start with the user's Microsoft account, Azure AD / Active Directory, exported files and printouts. Most times when a user gets "locked" out, the key is sitting in one of these locations.
In addition to decrypting BitLocker and BitLocker To Go volumes, the same suite also decrypts volumes created with FileVault, VeraCrypt, TrueCrypt and LUKS, as well as opening over 400 different types of password-protected file.
When BitLocker is used correctly there is no way to break the encryption without having access to the key. Therefore, professional and reputable services will obtain the keys needed to decrypt your data rather than 'breaking' the encryption. Our tool to do this is Passware Kit Forensic, and we will tell you exactly what we can achieve.
When posting a disk for decryption with us, please get a quote first, either via telephone (0800 689 0668) or by completing the free online diagnostic. Please include all of the key information you may have, including your 48-digit recovery key, the Microsoft or company account it may have been escrowed under, and any other exported key files or PINs. The more information you provide, the faster we will be able to perform the decryption and the lower the cost. A bare disk taken out of a machine travels fine in an anti-static bag or wrapped in aluminium foil.
Before sending anything, get a quote from us either by telephone or using our free online diagnostic. Then post your hardware to us (tracked and insured), or drop it off at our Guildford laboratory in person.
Sending a drive from a computer, laptop, MacBook, iMac, CCTV/DVR or server? You will need to remove the internal hard drive or SSD and send us just the drive, as we are unable to remove the drive for you. We also cannot recover storage soldered onto a motherboard, such as in Apple Silicon Macs and some thin laptops. Only drives that can be removed from a machine and sent to us can be recovered. If you are unsure whether your device has a removable drive, please call us before sending. RAID, server and SAN drives need to be removed from their enclosure and labelled by bay. For a NAS, send the disks themselves if they are removable, otherwise the entire NAS device. An external single drive should come to us whole, along with its cable and power supply.
↓ Print the booking-in & shipping form (PDF)
Please mark the package for the attention of Guildford Data Recovery, and we will call you as soon as we have diagnosed your media.
Unsure as to how to proceed with sending the item in for recovery? Then simply call 0800 689 0668, or complete the free online diagnostic prior to dispatching the item to obtain your price quotation.
Free diagnostic, fixed quote, and in most cases you only pay if we recover your data. Start now or call the freephone.