BLK / How the drive was locked / BitLocker To Go, USB and external drives

BitLocker To Go · encrypted USB · external drive · auto-unlock · password · recovery key

BitLocker To Go recovery. The encrypted USB stick or external drive that opened on one computer and now opens on none.

BitLocker To Go is BitLocker for removable drives: a USB stick, an SD card or an external hard drive, encrypted so it needs a password or the recovery key to open on any computer. It is the encryption people meet most on portable media, often set up by an employer, and it fails in a handful of recognisable ways. The commonest is auto-unlock: the drive was set to open automatically on one particular PC, the key for that was stored on that PC, and now the PC is gone, reinstalled or simply a different machine, so the drive asks for a password the owner never really used. Others forget the password they set, or lose the recovery key, or the drive itself fails while encrypted. As always, the 48-digit recovery key opens a To Go drive whatever has happened, so finding it comes first; a forgotten password may be recoverable if it was weak; and a failed To Go drive is imaged and then decrypted from the clone. The data is intact behind the encryption in every case where a key or weak password can be found. We recover To Go drives only for their owners, behind proof of ownership.

Owner-only, proof requiredFree first look£800 + VAT, one diskNo fix, no fee on the balance

Rather talk it through? An engineer answers the bench line
0800 6890668

Stop before you reinstall or reformat anything. If the machine is at the BitLocker recovery screen, the data is intact behind the key; reinstalling Windows, reformatting the drive or clearing the TPM again will not get you in and can overwrite what is there. Do not keep typing the wrong key until a device locks you out. If the machine is still running and unlocked, do not shut it down before you have read the lost-password pages. Find your recovery key first, and send nothing until you have.

Why it opened on one PC and not another.

If a To Go drive used to open by itself on your usual computer and now demands a password, the cause is almost always auto-unlock. When you tick to unlock a drive automatically on a PC, BitLocker stores an external-key protector for that drive in that PC's registry, so the drive opens without a prompt there, and only there. Reinstall Windows, move to a new PC, or try the drive on someone else's machine, and the stored key is not present, so the drive falls back to asking for the password or the recovery key. Nothing is wrong with the drive; it is doing exactly what it was set up to do.

So the way in is the password you originally set, or the 48-digit recovery key made when the drive was encrypted. Find the recovery key first, in a saved file, a printout, your Microsoft account, or an organisation's Entra ID or Active Directory for a work drive; the finder page covers each. With either, the drive opens on any computer.

If both are gone, a To Go drive is in the same position as any BitLocker drive with no openable protector: a weak password may be recoverable by a dictionary or mask attack, a strong one is not, and a modern AES drive with neither a key nor a weak password cannot be opened. Where the drive has also physically failed, which external drives and old sticks do, we image it first and then decrypt the image. The free look tells you which of these yours is.

The ways a To Go drive locks you out.

Auto-unlock tied it to one PCThe drive opened automatically on your old computer because the key was stored there. That PC is now gone or rebuilt, so the stored key is gone with it, and the drive asks for the password or recovery key it always had underneath. The drive is fine; the convenience key simply does not exist on this machine.

The password was set and forgottenPeople set a To Go password once and rely on auto-unlock thereafter, then cannot recall it when a new PC asks. The recovery key opens the drive without the password; if that is lost too, a weak password may be recoverable, a strong one not.

The recovery key is the universal way inWhatever has happened, the 48-digit recovery key opens a To Go drive on any computer. It is the first thing to find, and for a work-issued encrypted stick it is usually escrowed in the organisation's directory where IT can read it.

A To Go drive can fail like any driveUSB sticks wear out and external drives fail mechanically, encrypted or not. A failed To Go drive is imaged at the sector level first, then the image is decrypted with the key or recovered password. The failure is solved the usual way; the encryption is the extra step.

What you see, and what is behind it.

Describe yours to us →

What you see	What is usually behind it	Where that leaves you
Drive opened on my old PC, asks for a password now	Auto-unlock key was on that PC	Use the password or recovery key; the drive is fine
Forgotten the To Go password, recovery key held	The key opens it without the password	Enter the recovery key on any computer
Forgotten password, no key, simple password	A weak protector to attack	Often recoverable by dictionary or mask attack
Forgotten password, no key, strong password	No pattern to exploit	Not recoverable; we say so at the free look
To Go drive failed or will not read	A hardware fault plus the encryption	Imaged first, then decrypted from the clone

From the drive arriving to your files going back.

Work we have closed →

Logged the day it lands, and the first look costs nothing Free

A number goes on the parcel and the drive the day it is opened, matched to your enquiry by the booking sheet inside. Before anything is read we check the proof of ownership you sent. The drive is then connected through a write blocker, read-only, and examined: whether it is a healthy drive behind a lost key, or a failing drive behind a known key, is settled here, and so is whether what you want is possible. That first look is free, and you may stop at it owing nothing.

Nothing to pay for lookingProof of ownership checked firstRead-only, nothing written to the drive

Imaged at the sector level, before anything else

A drive that answers at all is imaged in full on a hardware imager, behind a write blocker, weak areas last, with a map kept of what could not be read. The image is a copy of the encrypted sectors, so it is useless to anyone without your key, which is a privacy gain in itself. Every later step is done on the image. The original drive is never decrypted, never written to, and never worked on directly.

Sector by sector, behind a write blockerNothing written to the original

The physical fault repaired on the clone, when there is one

A drive that has failed, that reads slowly or that drops out is stabilised and imaged in passes; a mechanically failed disk is repaired and read on the bench, a dead SSD controller read at the chip level, before any decryption is attempted. The aim at this stage is one clean image of the encrypted volume to decrypt from. Where the drive is healthy and the problem is only the key, this stage is skipped.

Mechanical and chip-level work where neededOne clean encrypted image to work from

The image decrypted with your key or password

With your recovery key, recovery password or the drive's password, the image is unlocked: the protector releases the Volume Master Key, the VMK releases the Full Volume Encryption Key, and the volume is decrypted from the clone. Where the metadata or header is damaged, repair-bde and the key package rebuild it at the block level onto a separate target. Where the key is lost but a memory image or hibernation file is available, the Volume Master Key is extracted from it with Passware. Without a key, a password to attack, or a memory capture, the volume cannot be opened, and you are told so at the free look.

Protector → VMK → FVEK → volumeDecrypted from the clone, never the original

The file system rebuilt, and the list before the bill

Once the volume is open it is an ordinary NTFS or exFAT file system, and any damage in it is repaired on the image and the files recovered. What was recovered is listed for you first, and only then does a bill exist. The files go home on fresh media. The original drive is returned, or securely destroyed at your request; we never send the key and the data by the same route.

Files listed before any invoiceFresh media, supplied with the job3–7 days at the bench

From the bench

If it used to auto-unlock and now asks for a password, nothing is wrong with the drive. The key lived on the old PC; use the password or recovery key instead.
For a work-issued encrypted stick, ask IT for the recovery key. It is usually escrowed in the organisation's directory.
Do not reformat a To Go drive to make it usable. Reformatting destroys the data you are trying to reach; the recovery key opens it intact.

Auto-unlock stores the key on one PC only, which is why a To Go drive that opened there asks for a password everywhere else.

One job, followed all the way through.

UK · BLK-2026-0706JOB LOGGED ✓

An encrypted external hard drive that had always opened on a now-dead office PC and refused every other machine, with a small firm's archived invoices on it

Auto-unlock, exactly. The drive had opened automatically on one PC whose key was in its registry, and that PC had died, so the drive asked for a password nobody had used in years. With ownership confirmed, we found the organisation had escrowed the recovery key in its Microsoft account; the 48-digit key opened the drive on our bench, and the archive was copied off. The drive itself was healthy; only the auto-unlock key had been lost with the old PC.

100% recovered; auto-unlock key replaced3 days at the bench

Illustrative example — replace with a genuine case

What helps, and what harms.

Do this much first

Look for the recovery key first; it opens it on any PC
Try the original password you set when encrypting it
Ask IT for the key if it is a work-issued drive
Send proof the drive is yours if it needs lab work

What sets us back

Reformatting the drive to make it accessible, which erases it
Assuming auto-unlock failing means the drive is broken
Paying anyone who promises to reset a strong To Go password
Prising a USB stick apart; send it whole

We recover BitLocker drives for the people who own them. Before any work begins we ask for proof that the drive is yours or that you are authorised to have it recovered: a purchase receipt, the device serial, a letter on company letterhead for a work machine, or written authorisation from the owner, together with photo ID and a signed authorisation. It is a condition of the work, not a formality, and it is what keeps the service on the right side of the Computer Misuse Act. A drive with no proof of ownership is returned unread.

Questions answered before you commit.

My encrypted USB drive used to open automatically and now wants a password. Why?

It was set to auto-unlock on one computer, which stored the key for it. That computer is now gone or reinstalled, so the stored key is gone, and the drive asks for the password or recovery key it always had. The drive is fine; use the password or the 48-digit key.

Can you recover a BitLocker To Go drive without the password?

With the 48-digit recovery key, yes, on any computer. Without the key, only if the password was weak enough for a dictionary or mask attack; a strong password on a modern drive cannot be recovered. The free look tells you which case yours is.

My external drive is encrypted and has stopped working. Is the data recoverable?

If you have the recovery key or password, yes: we image the failed drive and decrypt the image. The hardware failure is solved the usual way and the encryption is the extra step. Without any key and with a strong password, a modern encrypted drive cannot be opened.

Where is the recovery key for a work-issued encrypted stick?

Usually escrowed in the organisation's directory, Active Directory or Entra ID, where your IT department can read it out. Ask them first; it is the quickest route in, and it is required that the organisation authorise recovery of its own drive.

What does it cost?

If the recovery key opens a healthy drive, there is nothing to pay beyond the free look. A failed To Go drive, or a password attack, falls under single-disk recovery at £800 + VAT, 50% non-refundable on acceptance and 50% no fix, no fee.

Begin here if yours is doing the same thing.

Startup key on USB (.BEK) →BitLocker password recovery →How to find your recovery key →The drive failed or corrupted while BitLocker was on →USB flash drives, on the card site →

The data is behind the key, not gone.

Looking at it is free, and it begins with the one question that decides everything: do you have the recovery key or password, or can you retrieve it. Tell us what the recovery screen says and what the drive has done, send the proof that it is yours, and back comes a straight account of what is possible and the one price to do it. Until then, reinstall nothing and reformat nothing.

0800 6890668

Price my job Packing and posting

How the drive was locked

Manufacturers

Why you are seeing the recovery screen

What it costs, and what follows