The user is locked out of their laptop; there is no recovery key anywhere. There is a deadline. In this case the method of entry into the system wasn't a breach of the encryption (it was actually a key Windows had created, written to the disk and left there).
This is a scenario, not a case study. It illustrates a common failure type that we address on a regular basis, and how it is approached, written from the technical side (versus as part of a single customer project). Please visit our documented case files here.
A drive that is being used with BitLocker fails physically, but the recovery key is available. That isn't the problem. What can be a bigger issue, however, is that the physical failure is getting worse with time and your normal instinct is to unlock the drive and start copying your data as soon as possible.
Unlocked, with the power still applied, and still seeking and working until the last file has finished copying, the disk takes on wear and tear until it ultimately fails. If you've copied sixty per cent of the data when the disk finally gives up, you'll have sixty per cent of your original files.
Imaging does essentially the opposite of copying: you read the contents once, bypass the damaged areas for now, then come back later to read them again using another timing method. The resulting image contains a snapshot of the encrypted volume just as it existed at the moment it was copied, including ciphertext and everything else, and it is taken without needing the key at all.
The encryption key is next applied to the image. The drive is never required to perform an additional function.
BitLocker encrypts data in each sector at the volume level, with metadata located at the beginning of the volume that describes how the various sections are arranged. All information needed to decrypt the BitLocker data can be accessed without requiring the original hardware. When you have access to both the encrypted sectors and the encryption key, you can compute the plaintext anywhere.
This means a partial image still allows for partial decryption. A ninety-five per cent image will decrypt ninety-five per cent of its contents; the unreadable regions are displayed as corrupted areas within the decrypted volume rather than causing failure during decryption.
The one exception is the area containing metadata for the BitLocker volume. When the section of the volume containing the BitLocker header is part of the unreadable sectors, the entire volume cannot be decrypted. However, BitLocker stores duplicate metadata elsewhere on the volume for this purpose (i.e., so the metadata may often be recovered).
BitLocker recovery refers to gaining access to a Windows volume that was encrypted using BitLocker. Recovery occurs through use of either the 48-digit recovery key associated with that volume or via login credentials tied to that recovery key. If the drive has also failed, a read-only image of the disk is created prior to attempting to unlock the volume from that same image, rather than attempting to unlock the volume while working directly with failing hardware.
Typically within hours if the drive is good and the key is present. However, when a drive physically fails, the time frame will depend upon how long it takes to image the drive (usually about 3-4 working days). A complimentary 48-hour diagnostic will tell you what category you fall into.
No, there is no way to unlock BitLocker other than with the recovery key or with the credentials that were used when setting up the key; that's exactly why it exists, and no recovery company can crack it. Review your Microsoft account as well as any Azure AD or domain records that may exist from setup. If you have a printout from setup, review this also before assuming the key is lost.
This needs to be stated clearly since that is where people wish for exceptions. With the recovery key or password, encryption costs nothing extra and only slightly increases labour: essentially, just another standard drive recovery with an additional decryption step at the end.
Without either, there is simply no path forward. There are no shortcuts with AES when the key is correctly generated, nor is there a backdoor or a vendor override, and even hardware failures do not produce these.
Prior to deciding that the key is lost: check the Microsoft account that was used to configure the machine. On any work machine, ask IT (because they almost certainly have the recovery key in Azure AD or Intune).