Encryption protects your data from thieves — and occasionally from you. Why the recovery key matters more than the repair, and what to do before anyone reinstalls anything.
A laptop won't start. It shows a blue screen asking for a recovery key, or it hangs on the manufacturer's logo, or it offers to repair Windows and then fails. The owner rings their IT support, who suggests reinstalling Windows. And at that point, the most valuable thing in the whole situation — the encryption key — is usually about to be thrown away without anyone noticing.
Encryption is a genuinely good thing. Everything below is an argument for keeping it, not for switching it off. But it changes the nature of data recovery fundamentally, and it creates one specific vulnerability that almost nobody has thought about in advance.
The point that matters most
If you have no recovery key, encrypted data cannot be recovered. Not by us, not by anyone. No amount of laboratory work will get past modern encryption. Your backup, or your key, is the only route back to your files.
This is the part that catches people out. Many laptops purchased in the last five years are encrypted by default, and the owner has never been told.
You can check easily enough. On Windows, search for "Device encryption" or "BitLocker" in settings and see whether it's on. Look at your Microsoft account's recovery key page. If there's a key listed there for a machine you own, that machine is encrypted.
While everything is working, encryption is invisible. You turn the laptop on, you sign in, the drive unlocks, and you never think about it again. The recovery key is only needed when the normal unlock pathway breaks — and that happens far more easily than people expect.
Common triggers include a failed Windows update, a BIOS or firmware update, changes to secure boot or TPM settings, replacing the motherboard or battery, a corrupted system file, or simply a drive that is beginning to fail. In each case, the encrypted data is still sitting there perfectly intact on the disk. It is simply locked, and the lock is genuinely unpickable without the key.
This is the single most damaging response, and it is offered constantly and in good faith. Reinstalling the operating system does not recover your files — it replaces the system on the drive and, depending on the options chosen, may wipe the partition or generate a fresh encryption state that makes the old data permanently inaccessible.
Before anyone reinstalls anything, replaces a drive, or runs a "reset this PC" operation, stop and answer one question: where is the recovery key? If nobody can answer that, nothing further should be done until it has been established.
Sign in and look for the BitLocker recovery keys page. Keys for personal devices are usually stored here. This is the first place to look, and the most commonly successful.
For a company laptop, the key will be in their management system. Ask them before anyone touches the machine — they can often retrieve it in minutes.
On some business machines the key is printed and stored in a safe or a drawer. It's easy to forget it exists. It's worth asking whoever set the machine up.
On a Mac, FileVault keys may be escrowed to iCloud, or an institutional key may have been set by whoever manages the machines.
Beware of "recovery key" services
There are businesses that charge significant sums promising to unlock encrypted drives. Be extremely cautious. Genuine encryption does not have a back door, so anyone claiming they can break it is either planning to try to extract the key from you, attempting a brute-force attack that will almost certainly fail, or not being honest about what they can do. We will never charge you to find a key we cannot find.
The order of operations is important, and it's the opposite of what most people try.
First, the drive is imaged as it stands. That's a sector-by-sector copy taken while the drive is still locked, which preserves the encrypted data exactly as it is. From that point on, everything is done on the copy, never the original — so whatever happens next, the original is safe.
Second, the key is applied to the image. If you have the recovery key, the data becomes readable and the work is essentially a normal file recovery exercise. If the drive is also physically failing, the imaging step may be the difficult part, and a cleanroom may be needed before any of the rest is possible.
Third — and this is the case we wish we didn't have to describe so often — if there is no key, then there is no recovery. We will tell you that plainly rather than take your money and hope.
The difference a backup makes
Encrypted laptops fail in exactly the same ways as unencrypted ones. The only difference is what happens afterwards. With a current backup, an encrypted drive failure is an inconvenience — you replace the drive and restore. Without one, it is potentially the end of the data. Encryption raises the stakes on backups rather than lowering them.
If your machine won't boot, get in touch before anyone reinstalls anything. The drive may be perfectly healthy and simply locked, and a five-minute conversation about where the recovery key might be is considerably cheaper than replacing everything you've ever stored on it.
Your data may be perfectly intact and simply locked. Talk to us before anything is wiped — the assessment is free and there's no obligation.