A blue screen asking for 48 digits that nobody ever wrote down, sitting between a business and their own data. We locate escrowed keys for businesses in Swindon and Wiltshire; we also decrypt leavers' hard drives in bulk and recover failing encrypted disks through the encryption. However, all decryption happens without "cracking" the disk, because there is no such thing as cracked BitLocker.
All BitLocker jobs begin with a free diagnostic to work out what type of issue exists, and then we provide one fixed quote in writing before we start working.
In most cases you only pay if we recover your data. Electronic and mechanical failures and chip-level work are 50% upfront, with the balance only if we recover your data, while BitLocker, ransomware, DVR and forensic jobs are paid upfront once you accept the fixed quote. You'll find full pricing on the data recovery cost page.
Every BitLocker job begins by working out which fault matches the symptoms, and the 20 listed here cover almost everything that comes to our bench.
Hardware or firmware changes were made to the computer and affected the TPM's measurements. The data itself remains intact on the other side of the prompt.
Most of these issues are resolved at the escrow level, through a Microsoft account, a workplace directory, an exported file or a printed copy from the bottom of a drawer.
Weak to moderately strong passwords can be retrieved using a GPU-speed attack. If a truly strong password has been lost, we tell you so straight.
If someone fits a new motherboard, clears the TPM, performs a BIOS flash or toggles Secure Boot, the protection trips just as it was designed to.
Encrypted data partitions left orphaned by a reinstall will become accessible again once the key has been traced.
A dying drive under encryption is the compound emergency, so it is copied whole while still locked, and then decrypted from that copy.
Encrypted sticks and external hard drives have the same three doors: the key, the password or forensic recovery.
Drives from former staff members, decrypted in bulk against the organisation's escrowed keys.
Separated from its TPM, the volume locks; that's expected behaviour, and it is reversed using the recovery key.
Corrupted encryption headers on otherwise healthy drives are rebuilt first, then decryption follows.
Windows needs the 48 digits again after a UEFI update resets the security chip, and they can be recovered either through escrow or from what remains in the TPM.
A GRUB install or bootloader change puts the machine into recovery mode, exactly as designed.
Modern laptops quietly enable device encryption at first sign-in, so owners may not know they have BitLocker until they're locked out.
Keys stored in company directories are traced and matched to each drive by its identifier, right across a leaver estate.
Accounts often store several keys and the wrong one gets tried, but the key ID finds the correct one without guesswork.
Machines set up to boot from a key file on a USB stick lock down when the stick goes missing; however, both the escrow and TPM routes remain available.
A PIN will fade from memory if it's unused for months; however, the recovery key, not the PIN, is how you get back into the device.
If a business has been wound up and its Azure AD has been deleted, the drives may still turn up long afterwards, so we use the remaining options (escrow and TPM) to access them.
An encrypted drive bought on eBay and tied to its previous owner's account cannot be recovered unless you have the lawful cooperation of that owner.
If there's a power cut during a manage-bde decrypt, you will end up with a half-encrypted volume, which needs to be salvaged sector by sector from an image.
The vast majority of what people call "lost" BitLocker keys were never actually lost, they were simply stored somewhere and forgotten. In general, Windows will store a recovery key before encrypting your volumes, as follows: on a Microsoft account, in a workplace Azure AD or on-premises directory, as an exported text file or as a printed copy in a desk drawer. Additionally, modern laptops automatically enable encryption at first sign-in. Therefore, the first thing to do on any lockout is to systematically check all the accounts and directories the device has ever touched; this approach wins far more cases than any clever tooling.
For decryption we use Passware Kit Forensic (the same tool the forensic trade relies on). It's worth understanding its limitations and capabilities. Nobody can break correctly implemented AES, no matter how confident a website may sound. Passware recovers the keys, from memory captures and hibernation files, from the TPM, or through a GPU-based attack if a human password protects the volume. BitLocker and BitLocker To Go are the main ones, while VeraCrypt, FileVault, TrueCrypt and LUKS are all handled on the same bench. Bulk decryption of a whole estate's worth of leavers' drives is a routine service for our employer clients.
When an encrypted drive is failing, the order of operations is critical. Unlock attempts are the wrong move, since each one wastes the drive's final healthy hours proving nothing. Instead, the drive is imaged cold, still locked, on hardware rigs, and then decrypted from that stable copy using the recovered key. Some things to know before committing: BitLocker work is classed as forensic, quoted after the free assessment and paid upfront once you accept the fixed quote.
BitLocker recovery comes down to two tasks, finding the key and imaging with discipline (never breaking the code), and our bench reflects this:
The forensic trade's standard decryption suite pulls keys from memory captures, hibernation files and the TPM, or attacks passwords at speed to find them. It will pull keys, but it will never break AES.
On a computer that will still start, the live key to a locked volume can sometimes be recovered straight out of RAM or hibernation data, and that is typically the fastest legitimate way in.
Racks of both NVIDIA and AMD video cards run dictionary and brute-force attacks at tens of thousands of guesses per second.
When an encrypted hard disk is failing, it is copied in its entirety while it remains locked, write-blocked throughout, so decryption only takes place afterwards on that stable image.
A patient search through Microsoft account details, workplace directories, exported key files and paper records, which is normally where the key turns up and the lockout is won.
As well as BitLocker and BitLocker To Go, the bench also opens FileVault, VeraCrypt, TrueCrypt and LUKS, and hundreds of different file types that are protected with passwords.
BitLocker on a sound drive with the key missing stays locked, end of story, regardless of what some vendor says about being able to recover the volume. Real recovery means recovering the actual key, which is exactly what Passware Kit Forensic does here on this bench, and if the key really is gone you will be told straight. As forensic-level work it is paid upfront once you accept the fixed quote, and the assessment beforehand is free.
Get a quote first, by phone or with the free online diagnostic, before we start. Then send us the drive along with whatever key material you have; this includes a 48-digit recovery key if one was ever saved, Microsoft or work accounts (which may hold the escrow), key files that were exported, PINs and best-guess passwords. Each piece of information you provide saves time and money on the job. A removed drive can be posted to us in an anti-static bag or wrapped in a sheet of kitchen foil.
Most customers get a quote first, by phone or with the free online diagnostic, and then post or courier their media to us.
Sending a drive from a computer, laptop, MacBook, iMac, CCTV / DVR or server? Please remove the internal hard drive or SSD and send us just the drive (from a server, every disk, each labelled with its bay), as we don't offer a drive-removal service. We don't recover storage soldered to a motherboard (for example T2 and Apple Silicon Macs and some thin laptops), only drives that can be removed and sent to us. If you're not sure which kind you have, ring us first.
↓ Print the booking-in & shipping form (PDF)
Mark the package for the attention of Oxford Data Recovery and we'll ring you as soon as we've diagnosed your media.
Not sure what to send? Ring 0800 689 0668 first or use the free online diagnostic.
Free diagnostic and a fixed quote, with BitLocker work paid upfront once you accept it. Start now or call the freephone.