The blue recovery screen requires a total of 48 digits that no one wrote down, and the drive that sits behind it is what holds the business. For companies and families in Swansea we are able to find escrowed keys, decrypt fleets of former staff members' drives and recover failing disks without ever attempting to break the encryption, since nobody can.
Free diagnosis with each BitLocker project. One fixed quote in writing from us prior to performing any service.
BitLocker recovery is classed as forensic work, so it is paid upfront once you accept the fixed quote. On our other services, in most cases you only pay if we recover your data. This is true of all of them except for failure of electrical/mechanical components, chip level repairs, DVRs and forensic analysis. Our full price list can be seen at the cost of data recovery page.
The first step in our BitLocker process is always to identify the problem with the symptoms: almost all faults fall into one of these fifteen areas.
The TPM's seal was broken when some form of hardware/firmware modification was made to the machine. Your data remains intact but locked until access is granted.
Most are recovered via escrow methods (Microsoft account details, Azure AD, export files, printouts in drawers).
A GPU-accelerated attack can retrieve weak and mid-strength passwords; a strong lost password will receive an honest answer instead.
A new board, or you clear the TPM, upgrade your BIOS and/or change Secure Boot: the seal will break exactly as it is intended to.
An encrypted data partition left behind after a reinstall of Windows will recover when the key is found.
Double trouble. The bad drive is failing while in an encrypted state. It is captured in its entirety (as a working image) while it is still locked, with decryption being saved for the copy.
USB and external encrypted volumes can be opened in the same three ways: by way of a key, a password or using forensics.
Ex-staff drives decrypt against the organisation's escrowed keys for all drives at once.
Moving a drive to another machine leaves the TPM (Trusted Platform Module) behind, and that locks the volume, which is the expected behaviour, but reversing this process will require the key.
An intact disk is decrypted after corrupted encryption headers on that disk have been repaired prior to decryption attempts.
After clearing or resealing the TPM via a UEFI firmware update, Windows requires a key from either escrow or from the TPM's own state to access data on the hard drive.
When GRUB is installed or the bootloader has been changed, it flips the machine into recovery mode by design.
When a user signs into their modern laptop for the first time, the device silently encrypts using BitLocker. The owner will be met with BitLocker when the laptop locks them out.
Escrow keys in organisational directories can be found and then matched against drive identifiers for all of the drives of an ex-employee estate.
Usually it is the wrong key, out of more than one key available for the same account. Each key has its own unique key identifier, and the right one gets matched properly by that, not by trial and error.
About half the work is going to be some detective work on this one; BitLocker typically does not activate unless it stores a recovery key somewhere, such as a Microsoft account, an Azure AD or Active Directory account (for a business computer), a .txt export of the key, or perhaps a printed copy you forgot about. Modern Windows will automatically and silently enable encryption of your devices upon initial login; therefore in most cases if you have a problem with being locked out you'll need to conduct a thorough search of all accounts your machine has ever interacted with. The other half is truly difficult to do because there are times when the drive is dying and encrypted simultaneously, and the order things get done in determines everything.
Our decryption bench uses Passware Kit Forensic (the same software that is widely used in the forensic field). This tool will never "crack" a BitLocker system that has been properly set up using an encryption method like AES; there is simply no way for anyone to break this type of secure encryption if you don't have access to the key (regardless of what some websites might promise). What we can do is extract recovery keys from memory captures and hibernation files, recover keys from the TPM (Trusted Platform Module) where applicable or use our GPU accelerated attacks to force disclosure of the underlying human password protecting the drive volume. BitLocker and BitLocker To Go are our core work, FileVault, VeraCrypt, TrueCrypt and LUKS jobs all use the same decryption bench too, and bulk decryption of leaver estates is a routine service for businesses.
The compound case rewards patience: bad sectors inside encrypted space, a laptop stuck at the recovery screen due to the failing disk underneath. Incorrect medicine is exactly what the unlock attempts are: each one spends the drive's remaining life on reads that prove nothing. The stable cold copy of the drive is captured still locked on the hardware rigs. Only that stable copy is then decrypted with the recovered key. Worth knowing: all BitLocker work is classed as forensic work; therefore it will be quoted after the free diagnostic and payable upfront.
BitLocker recovery uses two methods: finding the correct key and very carefully imaging the drive, but no code-breaking ever occurs. That is reflected in the lab environment:
Passware is the industry standard in forensic decryption suites. They allow us to find keys based on memory captures, hibernation file images and TPM data. If we cannot recover keys through these methods they also provide an accelerated password guessing method. They find keys, but they never break the AES.
The live key can be captured from either RAM or the hibernation file if there is a bootable device that will start up. This frequently represents the quickest way to get access to an inaccessible volume.
Multiple banks of high speed NVIDIA and AMD video cards working with rainbow tables are capable of generating tens of thousands of password guesses per second using brute force methods and dictionaries.
First the failing encrypted disk is copied through write blockers while it's still locked. Then the stable copy of the failing disk (not the actual disk) is decrypted.
Microsoft accounts, Azure AD, Active Directory, exported files and paper printouts: that's where most lockouts are genuinely won. They are won by a methodical search of these places.
In addition to BitLocker and BitLocker To Go, the bench decrypts FileVault, VeraCrypt, TrueCrypt, and LUKS (Linux) as well as over 400 other password-protected file types.
A sound BitLocker volume without access to the key will remain locked, full stop, regardless of who says otherwise. Recovery of the key is what legitimate recovery means, and it is exactly what Passware Kit Forensic provides here, with a truthful outcome either way. As with any type of forensic work that we do, payment is made upfront once the quote for services has been provided. The service of providing the forensic evaluation has no cost associated with it.
Once you have your quote, send all relevant key material with the drive: a copy of your 48-digit recovery key (if you have one), the Microsoft or workplace account that the key may be held in escrow under, exported key files, PINs and most likely password(s). Sending each item will reduce both time and cost. Removed drives are safe travelling in an anti-static bag or aluminium foil.
First get a quote over the telephone or use our free on-line diagnostic. The majority of customers then have their media sent to us via post, this is tracked and insured.
Do you want to send a drive from your computer, laptop, MacBook, iMac, CCTV / DVR or server? Please do not send the complete unit of computer or device with a hard disk drive (HDD) or solid state drive (SSD) inside. Please remove it and only send the drive itself. For a server, please remove all disks and label them by their bay. We will also not perform removal of internal drives from devices in order to access data. Also, we will not extract data from devices where storage is soldered onto the motherboard (such as T2 and Apple Silicon Macs and some thin laptops). Additionally, we do not recover data from phones and tablets, only drives that can be removed and sent to us. If you're not sure which kind you have, ring us first.
↓ Print the booking-in & shipping form (PDF)
Clearly mark the parcel with the name Bristol Data Recovery, and when your media has been diagnosed we will call you immediately.
If unsure about what to post, please call us first on 0800 689 0668 (the free phone number), or complete a free online diagnostic.
Diagnostic provided at no charge. Fixed quote, and as this is forensic-class work it is paid upfront. Start now or call the freephone.