How to recover files from a BitLocker-encrypted drive

How to unlock and recover a BitLocker drive

1. Find the password or recovery key

   Before you do anything to the drive, locate the BitLocker password or the 48-digit recovery key. The recovery key is often stored in the Microsoft account used on the PC, with a work or school IT department, on a printout or in a text file on a USB stick.

2. Start FileFix Ultimate as administrator

   Unlocking and decrypting a volume need administrator rights. Right-click FileFix Ultimate and choose Run as administrator. If the encrypted disk came out of a PC that no longer starts, connect it to a working Windows PC with a USB adapter first.

3. Select the drive in Deleted file recovery

   Open Deleted file recovery and pick the encrypted drive. When the volume is locked, the app shows Drive locked with BitLocker and an unlock form instead of starting a scan that could only find encrypted noise.

4. Enter the key and click Unlock

   Type the 48-digit recovery key or the BitLocker password and click Unlock. The app checks the format of each six-digit group and points out a group that was mistyped. Unlocking changes nothing stored on the drive, and nothing is sent over the network.

5. Scan and save to another disk

   After unlocking, the drive is checked again and can be scanned like any NTFS, FAT32 or exFAT volume. Files found through file system records return with their names and folders. Save them to a different physical disk, never back onto the encrypted drive.

6. If it will not unlock, decrypt to an image

   When the key is correct but the volume is too damaged to unlock, use Decrypt damaged BitLocker drive. Choose a folder on another drive with at least as much free space as the source, click Start decrypting, and when the decrypted image is ready click Scan this image.

Why a locked BitLocker drive shows nothing useful

BitLocker encrypts every sector of the volume, including the file system tables that record names, folders and deleted entries. Without the key, a recovery tool reading the raw disk sees data that looks random. Signature search cannot find photos or documents in it either, because the recognisable headers of those files are encrypted as well. That is why unlocking always comes first.

Once the volume is unlocked, Windows decrypts sectors on the fly as they are read. From then on the usual rules apply: deleted files that have not been overwritten can often be found, while files deleted long ago from an SSD with TRIM may already be empty.

Unlocking versus decrypting with repair-bde

Unlocking is the normal path and takes seconds. It works whenever the BitLocker metadata on the drive is intact, even if the files inside were deleted. Decrypting with repair-bde is meant for damaged volumes: the drive appears as RAW, Windows says the volume cannot be unlocked, or part of the metadata area was overwritten. repair-bde reads the encrypted sectors, decrypts them with your key and writes a plain image file to another drive.

The image needs free space equal to the size of the source drive, and a large hard drive can take hours. repair-bde is not part of every Windows edition; on some editions such as Home it may be missing, so the work may have to be done on another PC. The image holds your data in readable form, so keep it safe and delete it when you are done.

Common mistakes with encrypted drives

Formatting the drive because Windows offers to do so is the most damaging step. It replaces the BitLocker metadata, and afterwards even the correct key may no longer open the old data. Initialising the disk in Disk Management, or running repair tools that write to it, carries a similar risk, so leave the drive as it is until you have a key and a plan.

Another frequent mistake is mixing up keys. Each encrypted volume has its own recovery key, identified by a key ID. Compare the key ID shown on the BitLocker screen with the ID stored next to the key before typing 48 digits.

When recovery from a BitLocker drive is not possible

• Without the BitLocker password or the 48-digit recovery key, the data cannot be decrypted by this app or any other.
• A volume that was formatted or initialised after the problem began may no longer open with the old key.
• Files overwritten after deletion, or deleted long ago from an SSD with TRIM, are usually gone even after a successful unlock.
• If the disk clicks or keeps disconnecting, stop and consider a professional lab; repeated attempts on failing hardware can make things worse.

How FileFix Ultimate helps

• Detects a locked BitLocker volume and offers an unlock form for the recovery key or password.
• Checks the key format and flags a mistyped six-digit group before Windows rejects the key.
• Runs repair-bde for a damaged volume and writes the decrypted image only to another drive.
• Scans the unlocked drive or the decrypted image read-only and labels each result as verified, partial or extracted but unverified.
• Free for personal use, fully offline, with no account and no recovery limit.

Frequently asked questions