A locked-out laptop, no recovery key and a deadline — solved by lifting BitLocker's master key straight out of the machine's hibernation file.
A Newcastle architecture practice approached us after a senior member of staff moved on. The person's Windows 11 Pro laptop — a Dell running an NVMe system drive — had stopped booting cleanly following a failed feature update and dropped straight to the blue BitLocker recovery screen. The drive was locked with BitLocker (XTS-AES 256, sealed to the TPM behind a start-up PIN), and the 48-digit recovery key had never been escrowed to the firm's Microsoft 365 tenant or printed out. Months of live project files sat behind the encryption with nothing to unlock them.
The media itself was healthy — this was a key-management problem, not a mechanical one — but we never work on an original. We took the drive out, attached it behind a hardware write-blocker and captured a full, sector-by-sector forensic image (an .E01) of the encrypted volume. Our PC3000 handles acquisition where a drive is fragile or throwing read errors; here the NVMe imaged cleanly, and we checked the copy against a SHA-256 hash before going near it. Everything that followed happened against the image, leaving the original untouched.
For BitLocker decryption we use Passware Kit Forensic. A BitLocker volume can be opened at once if you can recover its Volume Master Key (VMK) — the key BitLocker itself relies on, which sits in RAM while the volume is mounted and gets written into the Windows hibernation file (hiberfil.sys) when the machine sleeps. With the laptop unbootable there was no live memory to capture, so in the normal run of things the recovery key or the user PIN would be the only way in — and we had neither.
The break came from the image. The laptop had Fast Startup switched on, and its last hibernation had been written while the encrypted volume was still mounted. We carved hiberfil.sys out of the image and turned Passware on it: the software pulled the VMK from the hibernation data, derived the Full Volume Encryption Key (FVEK) and produced a fully decrypted copy of the volume. As a by-product it also recovered the 48-digit recovery key, which we handed back so the firm could re-escrow it properly.
Once decrypted, the volume mounted as an ordinary NTFS partition. Every live project file, drawing and email archive was intact and went back on fresh media — three working days from drop-off to handover, with a firm recommendation that the practice turn BitLocker key back-up on across the office. Decryption is only ever carried out for the owner of the device, against signed authority from the business.
Passware Kit Forensic · PC3000 — imaging and recovery carried out in-house. Every job is imaged before any recovery work begins, and the original media is never written to.
Send us your device for a free diagnostic, and tell us a little about what happened — an engineer will review it and confirm your exact quote in writing before any work begins.
Getting your data back begins with getting the device to us. Pack it up safely, pop your contact details inside, and send it over — once we’ve run the free diagnostic, we’ll confirm your exact price in writing before any work starts.
Posting it? A tracked, insured service is what we’d recommend. Rather drop it in? You’re welcome Monday to Friday, 9am to 5:30pm — just package the device up as above first.
Want a bit more detail first? Fill in the form with more about your issue and an engineer will review it and send you a custom quote.
We’ll be in touch shortly. For anything urgent, call 0191 406 1051.
Sometimes — for instance by lifting the key from a memory image or hibernation file, or by recovering a failing encrypted drive. Decryption is only carried out for the equipment's owner.
From £800 plus VAT, with no fix, no fee on most jobs and a fixed quote before any work.
Yes — it makes recovery quicker and more certain, though we can sometimes get in without it.
Start with an instant online quote, or call and talk it through with us first. You'll have a clear, fixed price before any work begins.