Shut out of a laptop, no recovery key, a deadline bearing down — and the way in turned out to be BitLocker’s own master key, sitting in the machine’s hibernation file.
The client was a Guildford architecture firm; when a senior colleague moved on, the Dell laptop they’d used simply wouldn’t start. A half-completed feature update had left its Windows 11 Pro install dropping straight to that blue BitLocker recovery prompt the moment it powered on. On the NVMe system drive the partition was under BitLocker — XTS-AES 256, tied to the machine’s TPM and gated by a start-up PIN — yet the 48-digit recovery key existed nowhere: never saved into the firm’s Microsoft 365 tenant, never printed for the file. Locked away inside were months of active project work.
The original drive, as ever, was left entirely alone. Nothing was wrong with the media mechanically — this was purely a lost-key situation — but procedure is procedure: out came the NVMe, onto a hardware write-blocker, and a complete sector-by-sector .E01 image of the locked volume was taken. We verified that image against a SHA-256 hash before touching it; had the drive been frail or spitting read errors we’d have acquired it on the PC3000, but it copied over without a murmur. From there the physical disk went back in its bag and all the work ran on the image.
There’s a quicker route into a BitLocker volume that sidesteps the recovery key entirely — recovering the Volume Master Key. The VMK is the key BitLocker leans on at the bottom of the chain; whenever the volume is mounted it lives in memory, and each time Windows hibernates it gets tucked into the hibernation file, hiberfil.sys. A powered-down laptop hands you no live memory to grab, and with no PIN and no recovery key we’d usually have run out of road — except our image still carried a hiberfil.sys from the last time the machine had slept. Passware Kit Forensic lifted the VMK straight from it, derived the Full Volume Encryption Key and unlocked the volume. To be plain about it: nothing here was cracked or brute-forced — we simply retrieved a key Windows had itself left lying on the disk.
Unlocked, the volume came up as a standard NTFS partition with everything present — every project file, drawing and mail archive. It went out on fresh media three working days after the laptop had come in, together with a plain recommendation: switch BitLocker key escrow on right across the practice, so a mislaid key can never shut them out again. We only ever decrypt for a device’s own owner, and only on written authority from the business.
Passware Kit Forensic · PC3000 — the locked volume copied read-only, its Volume Master Key then retrieved from the hibernation file and used to open it. Done only for the equipment’s owner, on written authority.
Get the device to us for a free diagnostic and a quick note on what went wrong — an engineer looks it over and puts your exact quote in writing before anything is started.
The route to your data starts with the device reaching us. Box it up securely, tuck your contact details inside, and send it across — after the free diagnostic, we put your exact price in writing before a single step is taken.
Sending it by post? Go with a tracked, insured service. Prefer to bring it round? Our door is open Monday to Friday, 9am to 5:30pm — just pack the device as described above beforehand.
Prefer to get a sense of things first? Complete the form with a bit more about the fault and an engineer will look it over and send back a tailored quote.
We’ll get back to you soon. Anything pressing, call 01483 901310.
Occasionally, yes — say by retrieving the key from a hibernation file or a memory image, or by rescuing an encrypted drive that’s failing. The encryption itself is never broken, and we decrypt for the equipment’s owner alone.
It starts at £800 plus VAT; most jobs are no fix, no fee, and you’ll have a fixed quote before we start.
Absolutely — having it makes the job quicker and surer, though as this case shows we can occasionally manage without.
Kick off with an instant online quote, or ring us and talk it through first. Either way you’ll know a clear, fixed price before any work starts.