BLK / Why you are seeing the recovery screen / Asking for the recovery key after a Windows update

After a Windows update · feature update · recovery screen · intact data · 48-digit key

BitLocker recovery key after a Windows update. The update finished, the machine rebooted, and asked for 48 digits you did not expect.

This is the commonest BitLocker fright of all: a Windows feature update installs, the machine reboots, and instead of the desktop you get the blue BitLocker recovery screen asking for a 48-digit key. Nothing is wrong with your data. A feature update can touch the early boot components that the TPM measures, and when those measurements change, the TPM refuses to release its copy of the key as a security precaution, so BitLocker falls back to the recovery key. The drive is intact; it is sealed, not damaged. The fix is to enter the 48-digit recovery key, which is almost certainly stored in your Microsoft account or, for a work machine, your organisation's directory. Once you are back in, a simple step stops it happening on the next update. You only need us if the drive has also failed, or if the key genuinely cannot be found; the ordinary case is solved in minutes by finding the key, and this page shows you where.

Owner-only, proof requiredFree first look£800 + VAT, one diskThe honest answer either way

Rather talk it through? An engineer answers the bench line
0800 6890668

Do not reinstall Windows or reformat the drive. Your data is intact behind the key; reinstalling or reformatting writes over it and turns a find-the-key problem into real loss. Do not keep entering a wrong key from another device. The recovery key opens the drive; find it before you try anything else.

Why an update locks a drive that is perfectly fine.

BitLocker on a TPM machine seals its key to a set of measurements of the early boot process, taken when encryption was switched on. At every boot the TPM re-measures and, if the numbers still match, releases the key with no prompt. A Windows feature update can legitimately change those early boot components, the boot manager and related files, so the measurements no longer match. The TPM cannot tell a benign update from tampering, so it does the safe thing and withholds the key, and BitLocker asks for the recovery key instead.

That is the whole of it. The volume is untouched, every file is where it was, and the 48-digit recovery key opens the drive immediately. Enter it at the screen, Windows starts, and you are back exactly where you were. The recovery screen shows the first eight characters of the key's ID, which tells you, and us, which stored key to use if you have more than one device.

Once you are back in, you can stop this recurring. Suspending BitLocker and then resuming it, or more precisely letting Windows re-seal the key to the new boot state, makes the TPM trust the updated components, so the next update does not trip it. On managed machines this is often handled for you. The key point for right now, though, is simpler: the data is safe, and finding the key is the entire job.

What you see, and what it means.

Describe yours to us →

What you see	The usual reason	Where that leaves you
Recovery screen immediately after a feature update	The update changed the measured boot state	Enter the recovery key; the data is intact
It asks every time a big update installs	The key is not being re-sealed to the new state	Suspend and resume BitLocker after updating
Key ID on the screen matches one of several keys	You have more than one encrypted device	Use the key whose ID matches the screen
Key cannot be found anywhere	It was never escrowed, or the account is lost	Honestly assessed free; may not be recoverable
Drive also fails to read after the update	A coincident hardware fault	Imaged, then decrypted with the key

From the drive arriving to your files going back.

Work we have closed →

Logged the day it lands, and the first look costs nothing Free

A number goes on the parcel and the drive the day it is opened, matched to your enquiry by the booking sheet inside. Before anything is read we check the proof of ownership you sent. The drive is then connected through a write blocker, read-only, and examined: whether it is a healthy drive behind a lost key, or a failing drive behind a known key, is settled here, and so is whether what you want is possible. That first look is free, and you may stop at it owing nothing.

Nothing to pay for lookingProof of ownership checked firstRead-only, nothing written to the drive

Imaged at the sector level, before anything else

A drive that answers at all is imaged in full on a hardware imager, behind a write blocker, weak areas last, with a map kept of what could not be read. The image is a copy of the encrypted sectors, so it is useless to anyone without your key, which is a privacy gain in itself. Every later step is done on the image. The original drive is never decrypted, never written to, and never worked on directly.

Sector by sector, behind a write blockerNothing written to the original

The physical fault repaired on the clone, when there is one

A drive that has failed, that reads slowly or that drops out is stabilised and imaged in passes; a mechanically failed disk is repaired and read on the bench, a dead SSD controller read at the chip level, before any decryption is attempted. The aim at this stage is one clean image of the encrypted volume to decrypt from. Where the drive is healthy and the problem is only the key, this stage is skipped.

Mechanical and chip-level work where neededOne clean encrypted image to work from

The image decrypted with your key or password

With your recovery key, recovery password or the drive's password, the image is unlocked: the protector releases the Volume Master Key, the VMK releases the Full Volume Encryption Key, and the volume is decrypted from the clone. Where the metadata or header is damaged, repair-bde and the key package rebuild it at the block level onto a separate target. Where the key is lost but a memory image or hibernation file is available, the Volume Master Key is extracted from it with Passware. Without a key, a password to attack, or a memory capture, the volume cannot be opened, and you are told so at the free look.

Protector → VMK → FVEK → volumeDecrypted from the clone, never the original

The file system rebuilt, and the list before the bill

Once the volume is open it is an ordinary NTFS or exFAT file system, and any damage in it is repaired on the image and the files recovered. What was recovered is listed for you first, and only then does a bill exist. The files go home on fresh media. The original drive is returned, or securely destroyed at your request; we never send the key and the data by the same route.

Files listed before any invoiceFresh media, supplied with the job3–7 days at the bench

From the bench

The data is intact; this is a find-the-key job. An update changing boot measurements is exactly what the recovery key exists for.
After you are back in, suspend and resume BitLocker so the next update does not send you here again.
Send us the key ID from the screen if you are stuck. It identifies which stored key the drive wants.

Most post-update recovery screens are solved in minutes by entering the key from the owner's Microsoft account; no recovery work is needed.

One job, followed all the way through.

UK · BLK-2026-0708JOB LOGGED ✓

A home laptop that hit the recovery screen after a major Windows feature update, whose owner had never knowingly used BitLocker, with a freelance designer's active work on it

A classic update-plus-Device-Encryption case. The drive was healthy; the update had changed the boot state and the automatically-enabled encryption asked for its key. With ownership confirmed, we identified the Microsoft account the laptop used and the owner read the 48-digit key from account.microsoft.com/devices/recoverykey on their phone. It started at once, and we showed them how to suspend and resume BitLocker so the next update would not repeat it. No recovery work, nothing to pay beyond the free look.

100% intact; key found in the accountSame day once the account was identified

Illustrative example — replace with a genuine case

What helps, and what harms.

Do this much first

Find the 48-digit recovery key first
Check the Microsoft account you signed in with
Suspend and resume BitLocker once you are back in
Send proof the drive is yours if it needs lab work

What sets us back

Reinstalling Windows, which overwrites intact data
Reformatting the drive at the recovery screen
Entering a wrong key from another device over and over
Assuming the update destroyed your data; it did not

We recover BitLocker drives for the people who own them. Before any work begins we ask for proof that the drive is yours or that you are authorised to have it recovered: a purchase receipt, the device serial, a letter on company letterhead for a work machine, or written authorisation from the owner, together with photo ID and a signed authorisation. It is a condition of the work, not a formality, and it is what keeps the service on the right side of the Computer Misuse Act. A drive with no proof of ownership is returned unread.

Questions answered before you commit.

Why does Windows ask for a BitLocker key after an update?

A feature update can change the early boot components the TPM measures, so the TPM withholds its key as a precaution and BitLocker asks for the recovery key instead. Your data is intact; enter the 48-digit key and the machine starts. It is a security fallback, not data loss.

Is my data safe after this happens?

Yes. The drive is sealed, not damaged, and every file is where it was. The recovery key opens it immediately. Nothing about the update harmed the data; the TPM simply would not release its key after the boot state changed.

How do I stop it asking after every update?

Once you are back in Windows, suspend BitLocker and then resume it, which re-seals the key to the current boot state so the next update does not trip the TPM. On managed machines your IT department often handles this automatically.

What if I cannot find the recovery key?

Then the question is whether it was ever escrowed, usually to a Microsoft account or an organisation's directory, and whether you can get into that account. If the key is genuinely nowhere and the drive is a modern AES-256 drive, it may not be recoverable, and we tell you honestly at the free look.

What does it cost?

If the key is in your account and the drive is healthy, finding it costs nothing from us. Only a failed drive needs the lab, at £800 + VAT for single-disk recovery, 50% non-refundable on acceptance and 50% no fix, no fee.

Where this usually leads.

How to find your recovery key →Device Encryption on Windows Home →Recovery key after a BIOS or UEFI update →The recovery key is not accepted →TPM-only →

The data is behind the key, not gone.

Looking at it is free. Tell us what the recovery screen says, what happened just before it, and whether you can find your recovery key, and send proof the drive is yours. Back comes an honest account of what can be done and the one price to do it. Until then, reinstall nothing, reformat nothing, and clear no TPM.

0800 6890668

Price my job Packing and posting

How the drive was locked

Manufacturers

Why you are seeing the recovery screen

What it costs, and what follows