ASUS · ZenBook · VivoBook · ROG · MyASUS · AMD fTPM · recovery key
ASUS BitLocker recovery. An ASUS BIOS update, and the recovery screen on the other side of it.
ASUS laptops, the ZenBook and VivoBook lines and the ROG gaming machines, reach the BitLocker recovery screen the way other makes do: a BIOS or firmware update, through MyASUS or Windows Update, changes the boot measurements the TPM checks, the TPM withholds BitLocker's key, and the machine asks for the recovery key. The data is intact; the drive is sealed, not damaged. ASUS shares Lenovo's AMD angle, because many ASUS and ROG machines are AMD-based, and on AMD a firmware update or CPU change can reinitialise the firmware TPM, after which the machine will not boot without the recovery key; ASUS BIOS updates enabling or changing fTPM settings have prompted this for a good many owners. On a personal ASUS the key is usually in the owner's Microsoft account. The fix is to find and enter the key, and we are for lost keys and failed ASUS drives, which with the key are routine.
Rather talk it through? An engineer answers the bench line
0800 6890668
Why ASUS machines hit the recovery screen, and the AMD angle.
ASUS delivers firmware updates through MyASUS and Windows Update, and a BIOS or firmware update changes the early-boot measurements the TPM seals BitLocker's key to. Change them and the TPM withholds its key, so BitLocker asks for the recovery key. It is the ordinary firmware story across ZenBook, VivoBook and ROG.
Like Lenovo, ASUS has an AMD angle, and it has been particularly visible. Many ASUS and ROG machines are AMD-based, and ASUS BIOS updates that enable or change the firmware TPM (fTPM) setting have sent large numbers of machines to the recovery screen, because changing fTPM reinitialises it and the machine then needs the recovery key to boot. It is the same cause as any firmware trigger, made more common by fTPM-related BIOS changes on AMD ASUS boards.
The data is intact. Enter the 48-digit recovery key, usually from the owner's Microsoft account on a personal ASUS, or the organisation's directory on a managed one. Suspending BitLocker before a BIOS update avoids the prompt, and is especially worth it on AMD ASUS machines. If the ASUS drive has also failed, we image it and decrypt the image with the key.
What to know about ASUS and BitLocker.
What you see, and what is behind it.
Describe yours to us →| What you see | The usual reason | Where that leaves you |
|---|---|---|
| Recovery screen after an ASUS BIOS update | Firmware changed the TPM measurements | Enter the recovery key; the data is intact |
| ASUS will not boot after an fTPM BIOS change | The firmware TPM was reinitialised | The recovery key; nothing is wrong with the data |
| ROG machine asked for a key after MyASUS | A firmware update via ASUS's tool | Same cause; the recovery key opens it |
| Happens after enabling fTPM in the BIOS | Changing fTPM resets it | The recovery key; suspend BitLocker next time |
| ASUS drive also failed, key held | A hardware job with the key available | Imaged, then decrypted with the key |
From the drive arriving to your files going back.
Work we have closed →Logged the day it lands, and the first look costs nothing Free
A number goes on the parcel and the drive the day it is opened, matched to your enquiry by the booking sheet inside. Before anything is read we check the proof of ownership you sent. The drive is then connected through a write blocker, read-only, and examined: whether it is a healthy drive behind a lost key, or a failing drive behind a known key, is settled here, and so is whether what you want is possible. That first look is free, and you may stop at it owing nothing.
Imaged at the sector level, before anything else
A drive that answers at all is imaged in full on a hardware imager, behind a write blocker, weak areas last, with a map kept of what could not be read. The image is a copy of the encrypted sectors, so it is useless to anyone without your key, which is a privacy gain in itself. Every later step is done on the image. The original drive is never decrypted, never written to, and never worked on directly.
The physical fault repaired on the clone, when there is one
A drive that has failed, that reads slowly or that drops out is stabilised and imaged in passes; a mechanically failed disk is repaired and read on the bench, a dead SSD controller read at the chip level, before any decryption is attempted. The aim at this stage is one clean image of the encrypted volume to decrypt from. Where the drive is healthy and the problem is only the key, this stage is skipped.
The image decrypted with your key or password
With your recovery key, recovery password or the drive's password, the image is unlocked: the protector releases the Volume Master Key, the VMK releases the Full Volume Encryption Key, and the volume is decrypted from the clone. Where the metadata or header is damaged, repair-bde and the key package rebuild it at the block level onto a separate target. Where the key is lost but a memory image or hibernation file is available, the Volume Master Key is extracted from it with Passware. Without a key, a password to attack, or a memory capture, the volume cannot be opened, and you are told so at the free look.
The file system rebuilt, and the list before the bill
Once the volume is open it is an ordinary NTFS or exFAT file system, and any damage in it is repaired on the image and the files recovered. What was recovered is listed for you first, and only then does a bill exist. The files go home on fresh media. The original drive is returned, or securely destroyed at your request; we never send the key and the data by the same route.
From the bench
- Changing the fTPM setting on an AMD ASUS BIOS resets it, and the machine then needs the recovery key; have the key before touching fTPM.
- Suspend BitLocker before an ASUS BIOS update, especially on AMD machines.
- A failed ASUS drive is routine with the key. Do not reinstall over it; image and decrypt instead.
ASUS fTPM BIOS changes on AMD machines reinitialise the firmware TPM and have sent many owners to the recovery screen.
What helps, and what harms.
Do this much first
- Find and enter the 48-digit recovery key
- Have the key before changing fTPM or updating the BIOS
- Suspend BitLocker before ASUS firmware updates
- Send proof the drive is yours if it needs lab work
What sets us back
- Changing the fTPM setting without the recovery key in hand
- Reinstalling Windows over intact data
- Rolling back the BIOS to try to get in
- Assuming an fTPM reset destroyed your data; it did not
Questions answered before you commit.
Why does my ASUS ask for a BitLocker key after a BIOS update?
Because ASUS delivers firmware updates through MyASUS and Windows Update, and firmware is part of the boot chain the TPM measures. An update, especially one that changes the AMD firmware TPM setting, changed those measurements, so the TPM withheld its key and BitLocker asked for the recovery key. Your data is intact; enter the key.
I enabled fTPM on my ASUS and now it wants a BitLocker key. Why?
Changing the firmware TPM setting reinitialises it, so the chip no longer holds BitLocker's key, and the machine asks for the recovery key to boot. The data is untouched; enter the 48-digit key. In future, suspend BitLocker before changing fTPM or updating the BIOS.
How do I stop my ASUS asking for a key when it updates?
Suspend BitLocker before the firmware or BIOS update, and especially before changing any fTPM setting, then resume after. It lets the TPM re-seal cleanly so no recovery screen appears. It is the best habit for an AMD ASUS with BitLocker on.
Where is the recovery key for my ASUS?
On a personal ASUS running Windows Home, usually in the Microsoft account you signed in with, at account.microsoft.com/devices/recoverykey. On a managed ASUS, escrowed in your organisation's directory, where IT can read it out.
What does it cost?
If the key is in your account and the ASUS drive is healthy, finding it costs nothing from us. A failed ASUS drive falls under single-disk recovery at £800 + VAT, 50% non-refundable on acceptance and 50% no fix, no fee.
Begin here if yours is doing the same thing.
The data is behind the key, not gone.
Looking at it is free, and it starts with whether you have the recovery key or can retrieve it. Tell us the make and model, what the recovery screen says, and what happened just before it, and send proof the drive is yours. Back comes a straight account of what is possible and the one price to do it. Until then, reinstall nothing and reformat nothing.