A blue screen asking for forty-eight digits no one recorded, and a household or business that finds itself on the wrong side of it. There are three jobs that come out of this. Follow the escrowed key. Open leavers' machines in batches for an employer. Or take care of a drive that is failing and also locked at the same time. Cracked BitLocker does not exist; therefore, any vendor that even remotely suggests that there is such a product is selling you a tale.
Each and every BitLocker job is diagnosed free. Before any tools get used, we will give you a written fixed quote of what it costs.
In most cases you only pay if we recover your data. The exceptions are electronic/mechanical failures, chip level work, DVR and forensic jobs. All pricing information can be found on the data recovery cost page.
The very first thing we do on each BitLocker job is match the symptoms with the fault. After over twenty years working in this field, these twenty-five faults cover almost all faults which make it to our bench.
When something changes with either the hardware or firmware (in other words, when the TPM measures a difference), then your data is locked behind a single long number. Usually, that number can be located and that's what this webpage says in a nutshell.
Nearly every one of them will eventually show up in escrow: whether it was a Microsoft account nobody remembers signing on to, an entry in a directory, an exported file, or a printout that has spent five years under a stapler. Intune and Active Directory still hold keys people forgot existed. The trawl is methodical, and most of the time it does find what it is looking for.
GPU-speed attacks will crack weak and medium-strength passwords. If you had a very good password but really did lose it, you'll receive a straight answer from us rather than a bill ticking away hour by hour.
A motherboard swap, clearing the TPM, flashing the BIOS, toggling Secure Boot or updating the UEFI: each one will trip the security mechanism, exactly as its designers intended. The recovery key is what resets that security mechanism.
If a reinstall created a condition where a previously used data partition (which is now "orphaned") would no longer be accessible, it would instantly become available once the recovery key for that particular partition was found. Underneath that reinstall there was nothing important written or overwritten.
The most complex scenario: failure of hardware while operating under active encryption. We capture the entire device while it is still encrypted, and then decrypt from a good copy of the device rather than attempting to decrypt from the failed one.
There are three ways to access an encrypted USB storage device, and they are the same three that open a system drive: use of your key, entry of your password, and lastly forensically recovering your key. That is in order of preference.
Drives that were left behind by departing employees are unlocked in bulk using the keys that your company has stored for escrowing purposes. Each key is linked to each individual drive based on identifier rather than trying to guess which key belongs to a particular drive.
If the volume is removed from the TPM, the volume is locked. This is exactly how this functionality is supposed to work and has no connection to misfortune. It may take several minutes to unlock if you have possession of the appropriate key. If you don't have possession of the correct key, unlocking will be significantly more time consuming.
Should BitLocker's own structures corrupt on a drive that is otherwise sound, we locate back-up versions of the corrupted structures and recreate the header information prior to attempting to decrypt the volume.
If you install Linux (or if you decide to rework your existing bootloader) then the measurements will differ and you will see the recovery prompt. It is predictable and reversible, and it happens to someone each and every week of the year.
The device encryption feature enables itself silently upon first sign-in on most new laptops. Usually owners are made aware of this by their first encounter with a lockout screen (which is an unfortunate timing for discovering something like this).
Over many years an account will have collected multiple keys, and the wrong key is selected as the initial attempt every time. Matching to the key identifier displayed on the screen eliminates all possibility of guessing.
When a machine boots from a keyfile stored on a USB thumb drive, once the thumb drive goes missing, the machine locks solid. Escrow and the TPM remain available nevertheless; therefore losing the thumb drive does not settle anything.
If you leave a TPM/PIN enabled environment unused for a couple of months the PIN will fade away to such an extent that it would surprise most users. The only method to gain access again is through use of the recovery key(s), which can usually be located somehow.
Company closed, directory deleted, hard drives sitting in a box in someone's garage. Wherever possible we try to use all available methods of recovering keys from escrow, plus the TPM if the machine still contains one.
The encryption that was previously set up is tied to the previous owner's account. It can only be accessed via their lawfully given consent. We inform you of this prior to any transfer of funds occurring, not after.
When a decryption process is interrupted by a power outage, there may be only half of the cipher remaining on the disk. An image can be created for salvage purposes, and both halves are treated appropriately based upon where the boundary fell.
An external drive is set up so that it unlocks when connected to a computer; however, after a reinstall of Windows, the external drive no longer unlocks automatically, as the original copy of the key was deleted along with the original installation. Typically escrow holds a copy of that key.
Hardware drives which perform the function of BitLocker fail due to issues specific to the hardware. The older "trust" model behind these drives was previously identified as having known vulnerabilities. This is handled at the drive level, and with candour.
Only one backup copy of a recovery key exists as a plain text file and it is placed exactly on the partition or volume that it is used to unlock. We find this amusing. Escrow finds it a good deal less amusing.
When in "used-space-only" encryption mode, files are encrypted but free space (older deleted versions of those files included) is left unencrypted, so carving will read all data that was not encrypted by BitLocker.
Recovery keys will be rotated automatically on all devices in a managed environment. So, if a device has not checked into the system as of a recent key rotation then it may be stuck with a recovery key that the directory changed weeks back. In most cases you will have to get both keys for that laptop to gain access. And typically the old key is going to be the correct one.
An example of this would be a user who has cloned an encrypted drive using a consumer level application, and frequently the copy does not come out at the same size, or the data is not aligned correctly. Or in some cases, the volume header is missing from the new image. The encryption was fine but the container did not build properly. While it is easy enough to rebuild an encrypted drive from the original, it can be very difficult to do so from a clone.
Typically after a series of incorrect PIN entry attempts you will be locked out by the security chip for an extended period of time, typically anywhere from several hours to a full night with the machine left powered down. The best way to resolve this situation is simply to wait. Repeatedly attempting to enter a PIN can cause the lock-out period to increase, rather than decrease.
First, focus on the positive. If a key has been described as lost, the odds are that it's simply misplaced and can be located by doing a thorough search. In other words, most keys aren't lost, they're simply stored somewhere that hasn't been searched. Windows virtually always escrows the key when locking volumes, and these keys will likely be found in one of the following locations (in no particular order): the user's Microsoft account, an Azure AD tenant used for work purposes, an on-premises directory, a previously exported .txt file that was subsequently forgotten, or a print-out that was placed in a drawer during a rushed handover. Then there is today's common pitfall. Laptops from recent years will automatically enable device encryption during the first sign-in, which is why so many household members find themselves locked out of drives that they had no idea were encrypted. Therefore, the first step in any lock-out situation is to perform a meticulous review of all accounts or directories that the machine has ever connected to. This process can take some time, but it solves more problems here than our high-priced tools do.
Decryption on this bench uses Passware Kit Forensic, which is used across the entire forensic industry as a standard tool. It is worth pointing out how this software works. This software will never break AES. No software can crack a properly implemented AES encrypted file, regardless of what the internet may say today about breaking AES. Passware will recover keys. Keys that were stored in hibernation files. Keys that are contained within memory captures. Keys that are straight from the Trusted Platform Module (TPM). Or keys found by aiming GPUs at a human-chosen password, where a password is the only guard on the door. BitLocker and BitLocker To Go are the everyday volume, and VeraCrypt, FileVault, TrueCrypt and LUKS get the same method on the same bench. Employers send drives with data from departing employees and these are processed on a batch basis.
In cases where a drive is encrypted and failing at the same time, how the process is ordered can be crucial. A common incorrect initial step to take is to make multiple unlock attempts. Each attempt will use up part of what remains of the operating life of the failing device (i.e., its "healthy" time remaining) and yield zero evidence. Instead, a complete image of the disk is made while still locked using forensic imaging hardware. Only after this is done, against a stable copy of the original data, does anyone try decrypting the data with whatever key has been traced. It's critical to have one piece of information before you engage. Because BitLocker comes under the category of forensic work, the assessment costs nothing; you'll receive a fixed quoted price based upon this assessment; and you pay that quoted amount prior to beginning the work rather than paying later.
As for how BitLocker work goes, we find the keys to unlock it and use controlled disk imaging. We do not break codes, and our equipment shows this:
The key-recovery suite this trade genuinely rates. This tool extracts keys from memory dumps, hibernation files, TPMs, etc. or can perform fast password attacks to reach keys. Keys are what it finds; nobody breaks the AES under the hood, us included.
If you have a computer that will still start, the live key can occasionally be pulled directly from RAM, or from the hibernation file. This is about the quickest lawful means of entering a system when possible.
Graphics silicon by the rack processes dictionary and brute-force attacks on passwords (several thousand guesses per second), round the clock without supervision.
A full image of a deteriorating encrypted drive is created, while it is still locked and write-blocked throughout. Decryption will be performed using the stable copy; the original drive will not be used for decryption.
The methodical trawl: Microsoft accounts, employer directory listings, records for Intune and Active Directory, exported files, paper in a drawer. In most of our cases this is where your problem ends.
First we go after BitLocker as well as BitLocker To Go, followed by FileVault, LUKS, VeraCrypt, TrueCrypt, and several hundred types of password protected files.
Even if you trust the advertising claims, there will be no access to a sound BitLocker volume without its key. The honest way of recovering it is to find this key. This can be done by: Trawling escrow for keys. Attempting to defeat the TPM. Using GPU power to brute-force the user's password. And giving a direct answer whenever the encryption key is actually lost forever. As forensic work, it is paid for at the point of quoting rather than on results, with no additional charge made simply for getting the quote. Call 0800 689 0668 and an engineer answers, not a pre-recorded message.
All of the keys (including the 48-digit key, if it was ever written down) associated with the hard disk and all of the accounts that could possibly hold escrow through either Microsoft or your employer as well as any of the key files you may have exported, your PINs as well as some of the passwords that you think you may have used along with their variants should accompany the hard disk. Each item that accompanies the hard drive shortens the clock. For storing your hard disk, an anti-static bag would be sufficient; or kitchen foil if need be. First get a quote over the telephone or using our free online diagnostic. Then post it to us via a postal service that tracks and insures packages, use one of your own couriers, or bring it to reception at our Edinburgh location, Edinburgh Data Recovery, 4 Redheughs Rigg, Westpoint, South Gyle, Edinburgh EH12 9DQ, open Monday to Friday, 9am to 5:30pm, with no appointment needed. We do not provide pickup services from our location.
Get a quote first by telephone or use our free online diagnostic. Most of what you see on this bench will then be delivered via tracked, insured post. This is one of the safest ways to move a failing drive and packages handed in at a North-East post office are normally delivered here the next working day.
Still attached to a laptop, desktop, MacBook, iMac, server or CCTV/DVR unit? Remove the hard drive or SSD first. The bare drive travels on its own; when removing disks from a server remove all the disks and label each disk by its bay. This lab does not take machines apart. Any storage that has been soldered onto a motherboard (as in T2 and Apple Silicon Macs and a couple of thin laptops) will not be worked on: if it will not unbolt, we cannot work on it. If you're not sure what type of machine you have, ring us first. Phones and tablets are also not taken on.
↓ Print the shipping & booking-in form (PDF)
Your parcel should be addressed to Edinburgh Data Recovery, approximately two and a half hours (and 130 miles) from Aberdeen via the A90; alternatively it can reach us the next working day by tracked post if this journey time / distance is prohibitive to travel. As soon as your drive has been scheduled in we will contact you.
Still unsure about what should be placed inside of the packaging? Please call us first on 0800 689 0668, or use our free online diagnostic tool to assist you in deciding which items belong inside of the packaging before sealing.
Free diagnosis, one fixed price quoted in writing, and in most cases you only pay if we recover your data. Start online or phone it in.