HP · EliteBook · ProBook · Pavilion · Spectre · HP Support Assistant · BIOS · recovery key
HP BitLocker recovery. An HP update through Support Assistant, and the recovery screen that came with it.
HP machines, the EliteBook and ProBook business laptops and the Pavilion and Spectre consumer lines, reach the BitLocker recovery screen the same way their rivals do: through firmware updates, delivered here by HP Support Assistant or Windows Update. A BIOS or firmware update changes the boot measurements the TPM checks, the TPM withholds BitLocker's key, and the machine asks for the recovery key. The data is intact; the drive is sealed, not damaged. On a personal HP the key is usually in the owner's Microsoft account; on a corporate EliteBook it is escrowed in the organisation's directory. HP's own guidance, like Microsoft's, is to suspend BitLocker before a BIOS update, which avoids the recovery screen. The fix is to find and enter the key, and we are needed only if the key is lost or the HP's drive has also failed, which with the key is a routine recovery. HP business machines are often managed, so for an EliteBook the first and usually successful step is to ask IT for the escrowed key.
Rather talk it through? An engineer answers the bench line
0800 6890668
Why HP machines hit the recovery screen.
HP delivers firmware and driver updates through HP Support Assistant and Windows Update, and a BIOS or firmware update changes the early-boot measurements the TPM seals BitLocker's key to. Change them and the TPM withholds its key, so BitLocker asks for the recovery key. It is the ordinary firmware story, and it applies across the EliteBook, ProBook, Pavilion and Spectre ranges.
The data is intact. Enter the 48-digit recovery key: on a personal HP running Windows Home it is usually in the owner's Microsoft account; on a corporate EliteBook or ProBook it is escrowed in the organisation's Active Directory, Entra ID or Intune, where IT reads it out. Because HP's business machines are so often managed, asking IT is usually the fastest route for those, and the finder page covers the personal case.
HP advises, as Microsoft does, suspending BitLocker before a BIOS update and resuming after, so the TPM re-seals cleanly and no recovery screen appears. For now, the key is the fix, and if the HP's drive has also failed, we image it and decrypt the image with the key.
What to know about HP and BitLocker.
What you see, and what is behind it.
Describe yours to us →| What you see | The usual reason | Where that leaves you |
|---|---|---|
| Recovery screen after an HP BIOS update | Firmware changed the TPM measurements | Enter the recovery key; the data is intact |
| HP asked for a key after HP Support Assistant | A firmware update via HP's tool | Same cause; the recovery key opens it |
| Corporate EliteBook at the recovery screen | Managed machine; key escrowed | IT reads the key from the directory |
| Happens every HP firmware update | BitLocker is not suspended first | Suspend before updating, resume after |
| HP drive also failed, key held | A hardware job with the key available | Imaged, then decrypted with the key |
From the drive arriving to your files going back.
Work we have closed →Logged the day it lands, and the first look costs nothing Free
A number goes on the parcel and the drive the day it is opened, matched to your enquiry by the booking sheet inside. Before anything is read we check the proof of ownership you sent. The drive is then connected through a write blocker, read-only, and examined: whether it is a healthy drive behind a lost key, or a failing drive behind a known key, is settled here, and so is whether what you want is possible. That first look is free, and you may stop at it owing nothing.
Imaged at the sector level, before anything else
A drive that answers at all is imaged in full on a hardware imager, behind a write blocker, weak areas last, with a map kept of what could not be read. The image is a copy of the encrypted sectors, so it is useless to anyone without your key, which is a privacy gain in itself. Every later step is done on the image. The original drive is never decrypted, never written to, and never worked on directly.
The physical fault repaired on the clone, when there is one
A drive that has failed, that reads slowly or that drops out is stabilised and imaged in passes; a mechanically failed disk is repaired and read on the bench, a dead SSD controller read at the chip level, before any decryption is attempted. The aim at this stage is one clean image of the encrypted volume to decrypt from. Where the drive is healthy and the problem is only the key, this stage is skipped.
The image decrypted with your key or password
With your recovery key, recovery password or the drive's password, the image is unlocked: the protector releases the Volume Master Key, the VMK releases the Full Volume Encryption Key, and the volume is decrypted from the clone. Where the metadata or header is damaged, repair-bde and the key package rebuild it at the block level onto a separate target. Where the key is lost but a memory image or hibernation file is available, the Volume Master Key is extracted from it with Passware. Without a key, a password to attack, or a memory capture, the volume cannot be opened, and you are told so at the free look.
The file system rebuilt, and the list before the bill
Once the volume is open it is an ordinary NTFS or exFAT file system, and any damage in it is repaired on the image and the files recovered. What was recovered is listed for you first, and only then does a bill exist. The files go home on fresh media. The original drive is returned, or securely destroyed at your request; we never send the key and the data by the same route.
From the bench
- For a corporate EliteBook, ask IT for the key first; it is almost certainly escrowed and quick to read out.
- Suspend BitLocker before an HP BIOS update, as HP advises; it avoids the recovery screen entirely.
- A failed HP drive is routine with the key. Do not reinstall over it; image and decrypt instead.
EliteBooks are usually managed, so their keys are escrowed in the organisation's directory and IT can read them out.
What helps, and what harms.
Do this much first
- Find and enter the 48-digit recovery key
- Ask IT for the key on a corporate EliteBook or ProBook
- Suspend BitLocker before future HP BIOS updates
- Send proof the drive is yours if it needs lab work
What sets us back
- Reinstalling Windows over intact data
- Rolling back the HP BIOS to try to get in
- Clearing the TPM, which removes another way in
- Assuming an HP update destroyed your data; it did not
Questions answered before you commit.
Why does my HP ask for a BitLocker key after an update?
Because HP delivers firmware updates through HP Support Assistant and Windows Update, and firmware is part of the boot chain the TPM measures. An update changed those measurements, so the TPM withheld its key and BitLocker asked for the recovery key. Your data is intact; enter the key and it starts.
Where is the recovery key for my HP EliteBook?
An EliteBook is usually a managed business machine, so its key is almost certainly escrowed in your organisation's Active Directory, Entra ID or Intune, where IT can read it out. Ask them first. A personal HP's key is usually in the owner's Microsoft account.
How do I stop my HP asking for a key when it updates?
Suspend BitLocker before the firmware or BIOS update and resume it afterwards, as HP and Microsoft advise. It lets the TPM re-seal to the new firmware so no recovery screen appears. It is the best habit for an HP with BitLocker enabled.
My HP's drive has failed and BitLocker was on. Can you recover it?
Yes, with the recovery key, and it is a routine job: we image the failed HP drive and decrypt the image with your key. The drive's failure is the problem; the encryption is just a decryption step once a clean image exists. Proof of ownership is required.
What does it cost?
If the key is in your account or your organisation's directory and the HP's drive is healthy, finding it costs nothing from us. A failed HP drive falls under single-disk recovery at £800 + VAT, 50% non-refundable on acceptance and 50% no fix, no fee.
Begin here if yours is doing the same thing.
The data is behind the key, not gone.
Looking at it is free, and it starts with whether you have the recovery key or can retrieve it. Tell us the make and model, what the recovery screen says, and what happened just before it, and send proof the drive is yours. Back comes a straight account of what is possible and the one price to do it. Until then, reinstall nothing and reformat nothing.