I upgraded my workstation from Windows 10 to Windows 11, but I physically disconnected the data drives during the process, which were encrypted with BitLocker. Now, I'm unable to access the drives because nobody has the recovery key. I've spent days trying to recover it without success. I came across some videos discussing how a BitLocker recovery key might be sniffed, but it's way over my head. Is there anyone in the Midwest who has the skills to help out? I'm willing to pay for the service. Just to note, my system is a Dell Precision 5820 with three locked drives totaling around 10TB. It was built in 2018 and has a discrete TPM 1.2 that was upgraded to 2.0 at some point. Any guidance would be appreciated!
4 Answers
I do this type of work regularly and can tell you there isn't a simple way to recover your keys through sniffing, especially if the upgrade wiped out the old data keys. You might have a chance if you have any backups or a copy of the OS from before the upgrade that could restore the key settings, but if everything was wiped, the options could be slim.
That’s the risk with imaging! If you can't find any old backups with the key, it may be time to contact Microsoft support regarding Azure or Intune recovery options.
Remember, you can only sniff keys if the system requests them from a server. If not, you're out of luck. Also, check your Microsoft account; sometimes the recovery key might be stored there.
I checked, but there were 52 recovery keys listed and none worked, which is super frustrating.
Sounds like a nightmare! It’s tough when you can't find anything that matches. Usually, there should be a key for the encrypted drives in your past backups.
Most people with the skills to do this won't help because it's illegal. The few that might are not who you want handling your computer. Recovering your own data is totally valid, but watch out for the laws in your area. It's a tricky spot!
Why would it be illegal to recover my own data? There are entire companies focused on data recovery! I even have some background in hacking, and those folks tend to be pretty decent.
It's not about legality if it’s your own data, but keep in mind that the TPM may be the issue here. If the key isn't tied to the TPM, sniffing won't help.
Reaching out to data recovery firms could be your best shot. Some might have the tools needed but may not promote that service publicly. Just be prepared to show proof of ownership. If the TPM isn’t unlocking the drives, sniffing for the key isn't possible. If you managed to create an image of the boot drive before the upgrade, you might be able to revert and unlock the TPM, but remember, this only works under certain conditions!
Can you recommend any recovery companies? I talked to a few and they didn't seem to know what to do.
Most of them can be cagey about their capabilities. Try finding ones that specialize in enterprise-level secure data recovery. They usually have the expertise.
Thanks for the info! I wanted to roll back the version, but unfortunately, I reimaged the system completely, so that's likely not possible.