After a BIOS or UEFI update · firmware · TPM measurements · Secure Boot · recovery key
BitLocker recovery key after a BIOS or UEFI update. You updated the firmware, and the machine asked for the one number you did not have ready.
Updating a computer's BIOS or UEFI firmware is good practice, and a classic way to land at the BitLocker recovery screen. Firmware is part of the early boot chain the TPM measures, so updating it changes those measurements, and the TPM, unable to tell a legitimate update from tampering, withholds its key. BitLocker falls back to the 48-digit recovery key. As with a Windows update, the data is completely intact; the drive is sealed, not damaged, and the key opens it at once. This catches people out particularly on desktops they have updated deliberately, and on laptops where the maker pushed a firmware update through Windows Update without it being obvious. The lesson for next time is simple, suspend BitLocker before a firmware update and resume it after, so the TPM re-seals to the new firmware, and manufacturers' own instructions often say exactly that. For right now, the fix is to find and enter the recovery key, and you only need us if the drive has also failed or the key is genuinely lost.
Rather talk it through? An engineer answers the bench line
0800 6890668
Why firmware updates trip BitLocker, and how to avoid it next time.
The TPM measures the firmware as part of the boot chain it seals the key to. A BIOS or UEFI update changes the firmware, so the measurements change, so the TPM withholds its key and BitLocker asks for the recovery key. It is the same mechanism as a Windows feature update, applied to a different part of the boot chain, and it is equally harmless to the data. Turning Secure Boot on or off has the same effect, for the same reason.
The fix now is to enter the 48-digit recovery key from your Microsoft account or your organisation's directory. The machine starts, nothing is lost, and you are back where you were. If the firmware update was pushed by the manufacturer through Windows Update, which is common on laptops, the recovery screen may be the first you knew of it; the cause is the same and so is the fix.
For next time, the clean approach is to suspend BitLocker before updating firmware and resume it afterwards. Suspending tells BitLocker to accept the next boot and re-seal its key to the new state, so the TPM is not surprised. Many manufacturers' firmware-update instructions say to do this, and it turns a firmware update from a recovery-screen event into a non-event. It is worth building into any firmware or BIOS update habit.
What you see, and what it means.
Describe yours to us →| What you see | The usual reason | Where that leaves you |
|---|---|---|
| Recovery screen right after a BIOS or UEFI update | The firmware measurements changed | Enter the recovery key; the data is intact |
| Laptop asked for the key after an automatic update | The maker pushed firmware via Windows Update | Same cause; the recovery key opens it |
| Recovery screen after toggling Secure Boot | Secure Boot state is measured too | The recovery key; re-seal by suspending and resuming |
| Happens every firmware update | BitLocker is not being suspended first | Suspend before updating, resume after |
| Drive also will not read after the update | A coincident hardware fault | Imaged, then decrypted with the key |
From the drive arriving to your files going back.
Work we have closed →Logged the day it lands, and the first look costs nothing Free
A number goes on the parcel and the drive the day it is opened, matched to your enquiry by the booking sheet inside. Before anything is read we check the proof of ownership you sent. The drive is then connected through a write blocker, read-only, and examined: whether it is a healthy drive behind a lost key, or a failing drive behind a known key, is settled here, and so is whether what you want is possible. That first look is free, and you may stop at it owing nothing.
Imaged at the sector level, before anything else
A drive that answers at all is imaged in full on a hardware imager, behind a write blocker, weak areas last, with a map kept of what could not be read. The image is a copy of the encrypted sectors, so it is useless to anyone without your key, which is a privacy gain in itself. Every later step is done on the image. The original drive is never decrypted, never written to, and never worked on directly.
The physical fault repaired on the clone, when there is one
A drive that has failed, that reads slowly or that drops out is stabilised and imaged in passes; a mechanically failed disk is repaired and read on the bench, a dead SSD controller read at the chip level, before any decryption is attempted. The aim at this stage is one clean image of the encrypted volume to decrypt from. Where the drive is healthy and the problem is only the key, this stage is skipped.
The image decrypted with your key or password
With your recovery key, recovery password or the drive's password, the image is unlocked: the protector releases the Volume Master Key, the VMK releases the Full Volume Encryption Key, and the volume is decrypted from the clone. Where the metadata or header is damaged, repair-bde and the key package rebuild it at the block level onto a separate target. Where the key is lost but a memory image or hibernation file is available, the Volume Master Key is extracted from it with Passware. Without a key, a password to attack, or a memory capture, the volume cannot be opened, and you are told so at the free look.
The file system rebuilt, and the list before the bill
Once the volume is open it is an ordinary NTFS or exFAT file system, and any damage in it is repaired on the image and the files recovered. What was recovered is listed for you first, and only then does a bill exist. The files go home on fresh media. The original drive is returned, or securely destroyed at your request; we never send the key and the data by the same route.
From the bench
- Suspend BitLocker before a firmware update next time. It re-seals the key to the new firmware and avoids the recovery screen entirely.
- The data is intact; this is a find-the-key job. Do not roll back firmware or reinstall to try to fix it.
- Laptop firmware often updates silently through Windows Update, so the recovery screen can be the first sign; the fix is still the key.
Suspending BitLocker before a firmware update, as many makers advise, turns a recovery-screen event into a non-event.
What helps, and what harms.
Do this much first
- Find and enter the 48-digit recovery key
- Suspend BitLocker before future firmware updates
- Check your Microsoft account or organisation's directory for the key
- Send proof the drive is yours if it needs lab work
What sets us back
- Rolling back the firmware to try to get in
- Reinstalling Windows over intact data
- Clearing the TPM, which removes another way in
- Assuming the firmware update corrupted your drive; it did not
Questions answered before you commit.
Why did a BIOS update make my computer ask for a BitLocker key?
The TPM measures the firmware as part of the boot chain it seals the key to. Updating the BIOS or UEFI changes those measurements, so the TPM withholds its key and BitLocker asks for the recovery key. Your data is intact; enter the 48-digit key and it starts.
How do I avoid this when I update firmware?
Suspend BitLocker before the firmware update and resume it afterwards. Suspending lets BitLocker accept the new boot state and re-seal its key, so the TPM is not surprised and you do not land at the recovery screen. Many manufacturers' instructions recommend exactly this.
My laptop updated firmware by itself and now wants a key. Is that the same thing?
Yes. Manufacturers often push firmware updates through Windows Update, so the recovery screen may be the first you knew of it. The cause and the fix are the same: enter the 48-digit recovery key from your account or your organisation's directory.
Can I just roll back the BIOS to get in?
Rolling back is risky and unnecessary. The data is intact behind the key, and the recovery key is the clean way in. Find and enter it rather than undoing the firmware update, which can cause problems of its own.
What does it cost?
If the key is to hand and the drive is healthy, entering it costs nothing from us. A failed drive falls under single-disk recovery at £800 + VAT, 50% non-refundable on acceptance and 50% no fix, no fee.
The data is behind the key, not gone.
Looking at it is free. Tell us what the recovery screen says, what happened just before it, and whether you can find your recovery key, and send proof the drive is yours. Back comes an honest account of what can be done and the one price to do it. Until then, reinstall nothing, reformat nothing, and clear no TPM.