After a BIOS update, your PC greets you with a blue screen asking for a 48-digit number. If you know where that number is, the problem is solved in two minutes. If not, it can cost you everything on the drive.
The short answer
BitLocker is the drive encryption built into Windows. It encrypts volumes with AES in XTS or CBC mode and 128- or 256-bit keys [1]. With a TPM, it makes sure the device hasn't been tampered with while it was switched off [2]. Device encryption is a simplified form that switches BitLocker on automatically on eligible devices [2]. Why does Windows ask for the BitLocker recovery key? Because BitLocker noticed a change it cannot verify, for example in firmware or hardware; then only the 48-digit recovery key unlocks the drive [3][4]. Our assessment: before you touch firmware, hardware or partitions, know where your recovery key is.
How it works
- The TPM as gatekeeper. BitLocker gives the most protection with a Trusted Platform Module, which works with BitLocker to ensure that the device hasn't been tampered with while the system was offline [2].
- Device encryption. Device encryption turns BitLocker on automatically on some devices and encrypts the OS drive and fixed drives, but not USB drives [2]. Starting with Windows 11, version 24H2, the earlier DMA and HSTI/Modern Standby prerequisites no longer apply, so more devices qualify [2]. Microsoft says device encryption is available on all Windows versions, while full BitLocker can be enabled in Pro, Enterprise, Pro Education/SE and Education [2].
- Where the key goes. With device encryption, an administrator who signs in with a Microsoft account uploads the recovery key to that account; on devices joined to Microsoft Entra ID or Active Directory, it is backed up there [2]. A device with local accounts only remains unprotected even though the data is encrypted [2]. When you turn BitLocker on manually, you choose where to save the key [5].
- What triggers recovery. Microsoft lists, among others, a changed BIOS boot order, added or removed hardware, moving the drive into another computer, turning off, disabling or clearing the TPM, and changes to firmware, boot manager or boot configuration data [3].
- The 48 digits. The recovery password consists of 48 digits in eight groups. You type it with the function keys, because the number keys don't work in the pre-boot environment on every keyboard [3].
- Suspend instead of hoping. Firmware updates that don't come through Windows Update can send the PC into recovery at the next restart unless you suspend BitLocker first; this applies when BitLocker doesn't use Secure Boot for integrity validation, which
manage-bde -protectors -getreports [3]. While suspended, the data stays encrypted, but the key is protected only by a clear key stored unencrypted on the drive until protection resumes [3]. - No back door. Microsoft Support cannot retrieve, provide or recreate a lost recovery key. Without it, you have to reset the device, which removes all of your files [4].
A practical example
Before a BIOS update, you check the system drive in a command prompt run as administrator:
manage-bde -protectors -get C:The list shows the key protectors, including the numerical password, which is the recovery key [7]. In PowerShell, (Get-BitLockerVolume -MountPoint C).KeyProtector shows the same objects [6]. Then check from another device at aka.ms/myrecoverykey that your Microsoft account holds a key [4], and suspend BitLocker before you flash the firmware [3]. This is a generic walk-through, not a log from our own PC.
Checklist
- Check whether your drives are encrypted before you change firmware, hardware or partitions [3].
- Find your recovery key now, at aka.ms/myrecoverykey, on a printout or on a USB drive, not when the blue screen appears [4].
- Keep a copy of the key outside the encrypted PC [4].
- Suspend BitLocker before firmware updates that don't come through Windows Update [3].
- Sign in with a Microsoft or work account if you rely on device encryption, because with local accounts only the drive stays unprotected [2].