Call us — 01223 655015
Mon–Fri · 9am–5:30pm · No fix, no fee
Start a free diagnostic →
BitLocker · explained

You probably have a key. You just did not save it.

Windows stores the recovery key by default as part of your Microsoft account information and corporations store the recovery keys on their own central systems. Therefore, most individuals who are under the impression they do not have access to a key actually have an unlooked-for backup somewhere. Begin with this single question: is the computer a company-supplied system, or a personal system?

Why it triggers
Where the key is stored
Minutes, if you have the key
// the short version

Nothing is broken. It wants proof.

The volume is tied to the surrounding machine via BitLocker. If you make any alterations to the machine's chain of trust (TPM, firmware, boot order), it will lock and ask you to validate ownership of the volume.

48
Digits in the key
TPM
Usually the trigger
Minutes
With the key
None
Ways around it
×Nobody can bypass BitLocker without the key or password, and any service claiming otherwise is not telling you the truth. That includes us. Before you assume that the key is gone, verify each area listed below; the key is automatically recorded far more often than people think.
// the key almost always exists

It has not been lost. It has not been looked for.

When BitLocker identifies an event (a firmware update, a hardware change, a motherboard replacement, sometimes nothing obvious at all) which it did not anticipate, it prompts for a 48-digit recovery key. The prompting for the recovery key is not an error condition and does not indicate that something has failed.

In the vast majority of cases the key exists and has simply never been looked for. Almost all keys are located in one of four locations and checking each does not cost anything.

If none of those contain your key then honestly your data is irretrievable. There are no shortcuts, no back doors, and no way for vendors to override AES with a properly created key. Anyone claiming to be able to bypass BitLocker is either attacking a weak password as part of a dictionary attack, or is lying to you about their ability to bypass BitLocker.

// where to look

Four places, in this order.

Your Microsoft account. Check for the recovery key at account.microsoft.com/devices/recoverykey. When setting up consumer devices which will use device encryption, this key will be automatically stored there. Most consumers don't know this exists.

Azure AD or Intune. If it's a work computer, contact your organisation's IT department. The number of BitLocker-related questions resolved this way exceeds the number resolved by every technical method combined, and it still works even after you've left the company.

A saved file or printout. When you enable BitLocker, the system offers to allow you to print or save the recovery key. Frequently, that file can be found in your Documents folder or stored on a USB drive in a drawer.

Active Directory. In older domain-joined environments, the recovery data is stored in Active Directory instead of in Azure. Your IT person can obtain it for you.

// questions

Answered.

It's usually a change to either the firmware or hardware that BitLocker sees as suspicious. Nothing has actually gone wrong. Type the key into the box and it will quit bothering you.

No, and nobody can. There isn't any other path available without the key or password, and that is the whole point of encryption.

If so, it is standard recovery work costing from £300 +VAT. First, the drive is copied. Then, the key is entered into the copy.

Then we are unable to assist. This is correct rather than an obstruction; this key belongs to the owner of the computer.