BLK / Why you are seeing the recovery screen / Forgot the BitLocker password

Forgot the password · recovery key first · weak vs strong · dictionary and mask · no backdoor

Forgot the BitLocker password. The password is gone, and what happens next depends entirely on two things.

Forgetting a BitLocker password feels like the end, and it usually is not, because of two things that decide everything that follows. The first is the 48-digit recovery key: on almost every BitLocker drive a recovery key was created when encryption was switched on, and it opens the drive without the password. So the first move is always to find that key, not to attack the password. The second thing matters only if the recovery key is also gone: the strength of the password you forgot. BitLocker deliberately makes password attacks slow, so a weak, human-memorable password, a word, a name, a date, a familiar pattern, can often be recovered by a dictionary or mask attack, especially if you can tell us roughly what it was like, while a long random password cannot be recovered by anyone. There is no backdoor and no master password. This page is the honest map of those two paths: find the key first, and if it is gone, understand which kind of password you had. We recover these drives only for their owners, behind proof of ownership.

Owner-only, proof requiredFree first look£800 + VAT, one diskThe honest answer either way

Rather talk it through? An engineer answers the bench line
0800 6890668

Look for the recovery key before you do anything else. It opens the drive without the password and makes a password attack unnecessary. Do not reformat the drive to make it usable; that destroys the data. Do not pay anyone who promises to reset a strong password; there is no backdoor.

Two paths: the key, then the password.

The recovery key, first. A 48-digit recovery key almost certainly exists for your drive, and it opens it without the password. Look for it in a saved file or printout, on a USB stick, in your Microsoft account for a personal machine or Device Encryption drive, or in your organisation's Entra ID or Active Directory for a work drive. The finder page walks through each. If you find it, you are done, and no password attack is needed.

The password, only if the key is gone. With no recovery key, the job becomes recovering the forgotten password, and this is where the honest distinction lies. BitLocker's key derivation is intentionally slow, capping attacks at a few thousand guesses a second even on strong hardware. So a weak, human password, something you could remember, is often recoverable by a dictionary attack (trying words, names, common passwords) or a mask attack (trying structured guesses when you recall the shape). A strong, random password has no pattern and too many combinations, and cannot be recovered by us or anyone.

What you remember is the deciding factor. The more you can tell us, the length, whether it was a word or a phrase, numbers you tend to use, the language, whether it had capitals, the better the odds and the shorter the time, because it narrows the search enormously. A password you remember the shape of is far more recoverable than one you recall nothing about. And to be completely clear: there is no Microsoft backdoor and no master password, so anyone promising to reset a strong BitLocker password without the key is not telling you the truth.

What you see, and what it means.

Describe yours to us →

What you see	The usual reason	Where that leaves you
Forgotten the password, recovery key held	The key opens it without the password	Enter the recovery key; no attack needed
Forgotten a simple or familiar password, no key	A weak protector with patterns to exploit	Often recoverable by dictionary or mask attack
Forgotten password, you recall its shape, no key	A narrowed search space	Good odds with a mask built from what you remember
Forgotten a long random password, no key	No pattern, too many combinations	Not recoverable; no backdoor; we say so
Drive also failing, key or weak password available	A physical job plus decryption	Imaged first, then unlocked on the clone

From the drive arriving to your files going back.

Work we have closed →

Logged the day it lands, and the first look costs nothing Free

A number goes on the parcel and the drive the day it is opened, matched to your enquiry by the booking sheet inside. Before anything is read we check the proof of ownership you sent. The drive is then connected through a write blocker, read-only, and examined: whether it is a healthy drive behind a lost key, or a failing drive behind a known key, is settled here, and so is whether what you want is possible. That first look is free, and you may stop at it owing nothing.

Nothing to pay for lookingProof of ownership checked firstRead-only, nothing written to the drive

Imaged at the sector level, before anything else

A drive that answers at all is imaged in full on a hardware imager, behind a write blocker, weak areas last, with a map kept of what could not be read. The image is a copy of the encrypted sectors, so it is useless to anyone without your key, which is a privacy gain in itself. Every later step is done on the image. The original drive is never decrypted, never written to, and never worked on directly.

Sector by sector, behind a write blockerNothing written to the original

The physical fault repaired on the clone, when there is one

A drive that has failed, that reads slowly or that drops out is stabilised and imaged in passes; a mechanically failed disk is repaired and read on the bench, a dead SSD controller read at the chip level, before any decryption is attempted. The aim at this stage is one clean image of the encrypted volume to decrypt from. Where the drive is healthy and the problem is only the key, this stage is skipped.

Mechanical and chip-level work where neededOne clean encrypted image to work from

The image decrypted with your key or password

With your recovery key, recovery password or the drive's password, the image is unlocked: the protector releases the Volume Master Key, the VMK releases the Full Volume Encryption Key, and the volume is decrypted from the clone. Where the metadata or header is damaged, repair-bde and the key package rebuild it at the block level onto a separate target. Where the key is lost but a memory image or hibernation file is available, the Volume Master Key is extracted from it with Passware. Without a key, a password to attack, or a memory capture, the volume cannot be opened, and you are told so at the free look.

Protector → VMK → FVEK → volumeDecrypted from the clone, never the original

The file system rebuilt, and the list before the bill

Once the volume is open it is an ordinary NTFS or exFAT file system, and any damage in it is repaired on the image and the files recovered. What was recovered is listed for you first, and only then does a bill exist. The files go home on fresh media. The original drive is returned, or securely destroyed at your request; we never send the key and the data by the same route.

Files listed before any invoiceFresh media, supplied with the job3–7 days at the bench

From the bench

Find the recovery key before attacking the password. It opens the drive directly and makes the whole question moot.
Tell us everything you remember about the password. It is the single biggest factor in whether an attack can succeed and how long it takes.
There is no backdoor. A strong password with no recovery key is genuinely unrecoverable; be wary of anyone who says otherwise.

What you remember about a forgotten password is the single biggest factor in whether it can be recovered.

One job, followed all the way through.

UK · BLK-2026-0710JOB LOGGED ✓

An encrypted data drive whose owner had forgotten a password set years earlier and had no recovery key, recalling only that it was two short words and a number, with a decade of family history research on it

No recovery key existed, so the password was the only way in. With ownership confirmed, we built a mask and dictionary attack from what the owner remembered: two short words, roughly their length, and a trailing number in a range they suggested. On GPU hardware the attack found the password in under a day. The research came back in full. Had the password been long and random, or had the owner remembered nothing about it, the honest answer would have been no.

Password found from what the owner rememberedUnder a day on GPU hardware

Illustrative example — replace with a genuine case

What helps, and what harms.

Do this much first

Find the recovery key first; it skips the attack
Tell us everything you remember about the password
Say how long it was and whether it was a word or a phrase
Send proof the drive is yours

What sets us back

Reformatting the drive to make it usable, which erases it
Paying anyone who promises to reset a strong password
Assuming a forgotten password always means lost data
Expecting a long random password to be recoverable; it is not

We recover BitLocker drives for the people who own them. Before any work begins we ask for proof that the drive is yours or that you are authorised to have it recovered: a purchase receipt, the device serial, a letter on company letterhead for a work machine, or written authorisation from the owner, together with photo ID and a signed authorisation. It is a condition of the work, not a formality, and it is what keeps the service on the right side of the Computer Misuse Act. A drive with no proof of ownership is returned unread.

Questions answered before you commit.

I forgot my BitLocker password. Can I still get in?

Yes, if you have the 48-digit recovery key, which opens the drive without the password, look for it first. If the key is also gone, a weak password can often be recovered by a dictionary or mask attack, but a strong random one cannot be recovered by anyone. The data itself is intact either way.

Is there a way to reset a BitLocker password without the key?

No. There is no Microsoft backdoor and no master password. The only ways into a BitLocker drive are a protector you can unlock, the recovery key, or, for a weak password, a successful password attack. Reset tools that claim to bypass a strong password without the key do not work.

How do you recover a forgotten password?

By an attack built around what you remember: a dictionary attack tries words, names and common passwords; a mask attack tries structured guesses when you recall the shape; a rule-based attack mutates likely candidates. The more you tell us about the password, the better the odds and the shorter the time. A strong random password cannot be recovered.

How long will it take, and will it definitely work?

It depends entirely on the password. A familiar word or a shape you can describe may fall in hours or a day; a password you recall nothing about is slower and less certain; a strong random password does not fall at all. The free look gives you an honest read before you commit anything.

What does it cost?

If the recovery key opens the drive, there is nothing to pay from us. A password attack falls under single-disk recovery at £800 + VAT, 50% non-refundable on acceptance and 50% no fix, no fee; the non-refundable half reflects the forensic effort, which depends on the password rather than on us.

Where this usually leads.

BitLocker password recovery →Lost the recovery key, no copy anywhere →How to find your recovery key →TPM and PIN →BitLocker To Go, USB and external drives →

The data is behind the key, not gone.

Looking at it is free. Tell us what the recovery screen says, what happened just before it, and whether you can find your recovery key, and send proof the drive is yours. Back comes an honest account of what can be done and the one price to do it. Until then, reinstall nothing, reformat nothing, and clear no TPM.

0800 6890668

Price my job Packing and posting

How the drive was locked

Manufacturers

Why you are seeing the recovery screen

What it costs, and what follows