A blue screen asking you to enter a 48-digit key you've never seen in order to access a drive that has all of your information. We provide home and commercial users throughout Sheffield with BitLocker recovery services to locate keys, decrypt whole batches of drives, and recover data from failing encrypted drives.
Free diagnostic on every BitLocker job. There will be only one fixed, written price quote prior to starting the work.
On most jobs, you only pay if we recover your data. For electronic, mechanical and chip-level work, we'll take half up front and the rest only if we're able to recover your data. Jobs involving BitLocker, ransomware, forensic or CCTV/DVR work are paid upfront once you accept the fixed quote. Complete pricing can be found on the data recovery cost page.
Each BitLocker job starts by matching the symptom to the fault. These ten represent nearly all of what makes it to the bench.
A hardware, firmware or update change caused BitLocker to go into recovery mode. Your data is still there, but the key simply needs to be located or recovered.
The key was saved elsewhere (a Microsoft or work account, a file or a printout) or can be extracted from the TPM or a memory dump.
Accelerated recovery can often recover the password protecting the volume, quickly if it's weak, with honest odds if it's strong.
A new motherboard, TPM reset, BIOS update or Secure Boot change invalidated the seal and forced a recovery key.
A reinstall could leave an encrypted data partition stranded, recoverable with the key or through key recovery.
Compound case: a dying encrypted drive is gently imaged while in its locked condition prior to attempting any decryption.
Encrypted removable media can be locked in the same way, and is unlocked using the key, the password or forensic recovery.
Decryption of large numbers of encrypted drives from departing employees and old computers using escrowed keys.
BitLocker goes into lock-down when a drive leaves its original computer. This is expected behaviour, recoverable with the key.
Damaged encryption headers on an otherwise good drive, rebuilt before decryption.
BitLocker recovery is really two disciplines. The first discipline involves locating keys people did not realise they possessed. Most times BitLocker won't activate without saving a recovery key somewhere: a Microsoft account, an organisation's Azure AD or Active Directory, an exported file or a printout. Many modern Windows laptops will turn on device encryption silently and store the key during the initial login, so the answer to most lock-outs is a systematic search through all of the accounts that were used on the computer. The second discipline is much harder: a drive that is both failing and encrypted at the same time.
In cases involving business drives or lawful investigations we use Passware Kit Forensic, the leading decryption software suite in the industry. It will not crack BitLocker, as properly implemented AES encryption without the key is designed to be unbreakable. Any company that claims they can break it is misleading you. What Passware Kit Forensic will do is find the key: extract it from a memory image or hibernation file, pull it from the TPM, or launch GPU-accelerated dictionary and brute-force attacks on the password that secures the volume. We decrypt BitLocker and BitLocker To Go, and the same suite handles FileVault, VeraCrypt, TrueCrypt and LUKS if you also have those. Organisations frequently send us collections of ex-employee and retired machine drives to decrypt in bulk against escrowed keys.
The compound case is the one we see most often from organisations: a BitLocker drive that is also failing. The failing drive has bad sectors within the encrypted section, or a laptop crashes into recovery-key limbo because its underlying drive is sick. As with many things in IT, order of operation matters. The drive is first gently imaged while it is in an encrypted state on a hardware imager. Then, after the imaging is complete, the stable image is decrypted with the recovered key, always in that order. Every attempt to unlock a failing encrypted drive is an expensive read that uses up whatever remains of its lifespan, which is why the honest advice is to stop immediately and send it in.
Recovering BitLocker requires locating keys and gentle imaging, not breaking codes. This philosophy is reflected at our bench:
Industry-standard decryption suite: it extracts BitLocker keys from memory images, hibernation files or the TPM, or recovers the password via accelerated attacks. It recovers the key; it does not break the AES.
On systems that can be run, the live encryption key is captured from RAM or the hibernation file, often the fastest path into a locked volume.
NVIDIA and AMD GPUs and rainbow tables accelerate dictionary and brute-force attacks against BitLocker passwords at tens of thousands of guesses per second.
Failing encrypted drives are imaged in their locked state through write-blockers first, so no modifications to the original occur and decryption takes place on the copy.
Systematic location of keys that were escrowed to Microsoft accounts, Azure AD or Active Directory, exported files and printouts: most lockouts are resolved here.
The same suite decrypts BitLocker To Go, FileVault, VeraCrypt, TrueCrypt and LUKS volumes, and more than 400 different password-protected file formats.
Properly applied BitLocker is unbreakable without possession of the key; true recovery involves recovering the key, not cracking the encryption. We use Passware Kit Forensic and tell you clearly what is achievable.
Are you sending a BitLocker drive for decryption? First get a quote by telephone on 0800 689 0668 or with the free online diagnostic, then include all the key material you have: the 48-digit recovery key, any exported key files or PINs, and the Microsoft or work account where it might be escrowed. In general, the more key material you are able to provide, the quicker and less expensive the decryption process will be. For a drive removed from a machine, an anti-static bag or aluminium foil wrap will suffice.
Our customers get a quote before sending their media to us, either by telephone on 0800 689 0668 or by completing our free online diagnostic. Once a customer has their quote, they post their media to us, tracked and insured.
Sending a drive from a computer, laptop, MacBook, iMac, CCTV / DVR or server? Please remove the hard drive or SSD from your machine and send us just the drive; we do not offer an internal drive-removal service. If you have a server or RAID system, please send us every disk, each clearly labelled with its bay. We cannot recover data from storage that is soldered directly onto the motherboard (for example Apple Silicon Macs and some thin laptops), so we need removable drives to be sent to us. If you are unsure which kind you have, ring us first.
↓ Print the booking-in & shipping form (PDF)
Mark your package for the attention of Leeds Data Recovery and we will contact you as soon as we have diagnosed your media.
Unsure about what to send? Call us first on 0800 689 0668 or complete our free online diagnostic.
Receive a free, no-obligation diagnostic and a fixed price quote for your BitLocker issue. The price is taken upfront when you agree to proceed. Get started now or call our freephone.