BitLocker, FileVault, and LUKS Disk Encryption Recovery Key Lockout¶

Va'ai i se mata lanu moana BitLocker Recovery i luga o Windows, loka FileVault fa'ailoga fa'aoga i macOS, po'o se le tali mai cryptsetup passphrase prompt on a Linux workstation can bring your work and personal life to a halt. Full-disk encryption (FDE) uses military-grade symmetric ciphers, typically AES-128 or AES-256 in XTS mode, to scramble every sector of your solid-state drive (SSD) or hard disk drive (HDD). Without the cryptographic Volume Master Key (VMK) or a valid key-encryption protector, the raw data on the NAND flash chips is mathematically indistinguishable from random noise.

However, a sudden recovery key screen rarely means your drive is damaged or your key has vanished forever. Most BitLocker and FileVault lockouts are triggered automatically when a routine BIOS/UEFI firmware update, Thunderbolt dock change, Secure Boot toggle, or dead CMOS coin-cell battery alters the Platform Configuration Registers (PCRs) inside your motherboard Trusted Platform Module (TPM 2.0). Even if you never wrote down a recovery key, you can often bypass the prompt by reverting the exact UEFI firmware setting that tripped the TPM measurement, or by locating a silent automatic backup of your key inside a personal Microsoft account, a work or school Microsoft Entra ID directory, an Apple iCloud keychain, or an unmounted volume shadow copy.

Fai nei loa¶

1. STOP before clicking "Reset this PC", "Erase Mac", or formatting the partition. Reinstalling Windows, macOS, or Linux over an encrypted partition overwrites the cryptographic volume header (the BitLocker metadata blocks, the APFS container superblock, or the LUKS2 JSON header). Once that small metadata header is overwritten, even finding your valid 48-digit recovery key tomorrow will no longer decrypt your files.
2. Unplug all external USB drives, SD cards, Thunderbolt docks, HDMI adapters, and gaming controllers, then reboot. On Windows systems using TPM 2.0 Platform Configuration Registers (specifically PCR 0, PCR 2, PCR 4, and PCR 7), booting with a bootable USB thumb drive, a newly attached Thunderbolt dock with Option ROM firmware, or an external monitor hub can change the pre-boot hash measurement. Unplugging every peripheral and performing a cold reboot frequently allows the TPM to release the Volume Master Key normally without needing the 48-digit code.
3. Check every Microsoft, Apple, or corporate account you have ever used on a secondary phone or laptop. Do not assume you know which email account was active when the laptop was first unboxed. On Windows, check account.microsoft.com/devices/recoverykey across your personal Outlook/Hotmail/Live accounts, and check aka.ms/myrecoverykey on any work, university, or client Microsoft 365 (Entra ID) account you ever signed into inside Microsoft Word, Teams, or Windows Settings.
4. Match the first 8 characters of the "Key ID" displayed on your locked screen. A Windows BitLocker recovery screen displays a 32-character Key ID (or the first 8 hexadecimal characters, such as A1B2C3D4). If you have multiple keys stored in your Microsoft account or on old computers, only the 48-digit recovery password whose Key ID matches those exact 8 characters will unlock this specific drive volume.
5. Revert any recent BIOS/UEFI changes made right before the lockout. If the BitLocker screen appeared immediately after you entered BIOS setup to turn off Secure Boot, toggle CSM (Compatibility Support Module), change Intel PTT / AMD fTPM, or enable ** Boot Order changes**, reboot into BIOS (F2, F12, pe Del) and set those exact toggles back to their prior state. As soon as PCR 7 and PCR 0 match their original cryptographic hash, the TPM will unseal the key automatically.
6. Prioritize physical safety if the lockout occurs during an emergency or domestic crisis. If you are attempting to retrieve medical records, financial documents, or evacuation plans during a crisis, remember that encrypted drives retain data indefinitely while powered off. If you face an immediate physical threat, leave the hardware behind and call your local emergency number (911 in the United States and Canada, 112 across the European Union, 999 in the United Kingdom, or see our numera fa'afuase'i directory).

Disk encryption lockout triage and recovery decision tree¶

flowchart TD
    Start["Locked Out of Encrypted Drive: BitLocker, FileVault, or LUKS Prompt"] --> WhichOS{"Which Operating System and Encryption Engine?"}

    WhichOS -->|"Windows: BitLocker 48-Digit Recovery Screen"| PeriphCheck["Step 1: Unplug all USB drives, Thunderbolt docks, and external monitors; cold reboot"]
    PeriphCheck --> StillLocked{"Still asking for 48-digit key?"}
    StillLocked -->|"No: Booted Normally"| BackupNow["Immediately run 'manage-bde -protectors -get C:' and save 48-digit key offline"]
    StillLocked -->|"Ioe"| BIOSCheck{"Did you just change BIOS, Secure Boot, CSM, or update firmware?"}

    BIOSCheck -->|"Ioe"| RevertBIOS["Enter UEFI Setup: Re-enable Secure Boot, UEFI Boot Mode, and Intel PTT / AMD fTPM to restore PCR 7 hash"]
    BIOSCheck -->|"Leai"| HuntKey["Step 2: Match 8-Char Key ID across ALL Personal Microsoft Accounts, Work/School Entra ID, Active Directory, and USB .BEK/.TXT files"]
    RevertBIOS --> HuntKey

    WhichOS -->|"macOS: FileVault Login Rejects Password"| ApplePath{"Apple Silicon/T2 Mac vs Intel Mac?"}
    ApplePath -->|"All Macs"| TestLayout["Step 1: Check Input Menu in top-right of FileVault screen for keyboard layout mismatch"]
    TestLayout --> FVMethod{"Which Recovery Method Was Enabled?"}
    FVMethod -->|"iCloud Account Escrow"| BootRecovery["Boot to macOS Recovery: Authenticate with Apple Account via Recovery Assistant to reset password"]
    FVMethod -->|"24-Char Personal Recovery Key (PRK) or MDM"| EnterPRK["Enter XXXX-XXXX-XXXX-XXXX-XXXX-XXXX key in Recovery Assistant or request Institutional Escrow Key from IT"]

    WhichOS -->|"Linux: LUKS / cryptsetup Passphrase Rejected"| LUKSPath["Step 1: Drop to initramfs shell or boot Live USB; check keyboard layout in console"]
    LUKSPath --> LUKSHeader{"Are Keyslots Intact in 'cryptsetup luksDump'?"}
    LUKSHeader -->|"Yes: Keyslot Active"| TestPass["Test secondary keyslots (Slot 1-7), FIDO2/TPM2 token, or run hashcat Mode 29500 against header backup"]
    LUKSHeader -->|"No: Header Corrupted"| RestoreHeader["Restore LUKS header from '--header-backup-file' or scan disk for surviving metadata"]

Understanding Full-Disk Encryption and TPM 2.0 sealing¶

Neither Windows BitLocker, Apple FileVault 2, nor Linux dm-crypt / LUKS encrypts your SSD directly with your login password or recovery key. Instead, all three platforms use a two-tier key hierarchy:

1. The Volume Master Key (VMK) / Full Volume Encryption Key (FVEK): A hardware random key (128-bit, 256-bit, or 512-bit) encrypts and decrypts the actual disk sectors on the fly.
2. Key Protectors / Keyslots (KEKs): The Volume Master Key is wrapped using independent Key Encryption Keys (KEKs), called Key Protectors in BitLocker, Key Bags in Apple APFS, and Keyslots in Linux LUKS.
3. Why TPM 2.0 sealing locks you out on Windows: On Windows 10 and 11, the primary key protector is the Trusted Platform Module (TPM 2.0) chip (discrete silicon or firmware Intel PTT / AMD fTPM). When BitLocker seals the Volume Master Key into the TPM, it binds the key to specific Platform Configuration Registers (PCRs):
4. PCR 0: Hashes core UEFI/BIOS system firmware.
5. PCR 2: Hashes pluggable external hardware Option ROM code (Thunderbolt docks, RAID cards, external GPUs).
6. PCR 4: Hashes the boot manager (bootmgfw.efi) and boot order state.
7. PCR 7: Hashes Secure Boot policy and UEFI db / dbx certificate databases.
8. PCR 11: Hashes BitLocker access control components.

Whenever you press the power button, the motherboard measures these firmware components before Windows loads. If any single bit in PCR 0, PCR 2, PCR 4, or PCR 7 differs from the value recorded when BitLocker was sealed, the TPM refuses to release the Volume Master Key and forces Windows Boot Manager to display the 48-digit BitLocker Recovery Key screen.

Comparison of Full-Disk Encryption architectures and recovery mechanisms¶

Part 1: Resolving Windows BitLocker recovery lockouts¶

When your Windows PC halts at "BitLocker: Enter the recovery key for this drive" (or Windows Recovery Environment asks for a key before allowing Command Prompt or Safe Mode access), work through these two parallel tracks: Track A attempts to coax the TPM into unlocking the drive without needing the key, and Track B hunts down the 48-digit key across every digital and local storage location.

Track A: Bypassing the BitLocker prompt without a recovery key (Restoring TPM PCR state)¶

If you did not manually wipe the TPM or move the NVMe SSD into a new motherboard, the Volume Master Key is still inside your TPM 2.0 chip. It is refusing to unlock because a pre-boot PCR measurement changed. Try these non-destructive hardware and firmware restores in order:

1. Disconnect all external hardware and docks:
2. Power the computer completely off (hold the power button for 10 seconds).
3. Unplug every USB flash drive, external hard drive, USB-C hub, Thunderbolt docking station, SD card, and external monitor cable.
4. Unplug the AC charger for 15 seconds, plug the native charger directly into the laptop, and turn it on. Thunderbolt docks and USB-C hubs frequently contain internal PXE network boot or display Option ROMs that extend into PCR 2 and PCR 4, invalidating the TPM state.
5. Restore Secure Boot and UEFI Boot Mode in BIOS Setup:
6. Reboot and press your motherboard BIOS key (F2 on Dell/ASUS/Lenovo/Acer, F10 on HP, Del on desktop boards).
7. If Secure Boot was recently changed from Enabled to Disabled, set it back to Enabled (Standard Mode) and save changes. Conversely, if a BIOS update flipped Secure Boot to Enabled, try toggling it to Disabled once.
8. Confirm Boot Mode is set to UEFI Only (disable Legacy / CSM) and confirm Windows Boot Manager is the first boot option.
9. Verify Intel PTT or AMD fTPM is enabled (Never click "Clear TPM"):
10. After a dead CMOS battery or a BIOS reset, motherboards sometimes disable the firmware TPM (Intel Platform Trust Technology pe AMD CPU fTPM). Go to the Security or Trusted Computing tab in BIOS and confirm TPM 2.0 State is Enabled.
11. Warning: Never select "Clear TPM" or "Erase fTPM NV" inside BIOS. Clearing the TPM permanently destroys the internal Storage Root Key inside the silicon chip, making the 48-digit recovery key mandatory.
12. Roll back a buggy BIOS capsule update:
13. On Dell laptops, hold Ctrl + Esc while plugging in AC power to launch the Dell BIOS Recovery menu and select Rollback BIOS. On HP laptops, hold Win + B while pressing the power button for 2 seconds to trigger HP Sure Start BIOS rollback.

Track B: Exhaustive search for your 48-digit BitLocker Recovery Key¶

If the TPM cannot be restored (or if you moved the SSD into an external USB enclosure), you must supply the 48-digit numeric recovery password (XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX) or a .BEK startup key file. Write down the first 8 characters of the Key ID shown on screen (for example, Key ID: 4F8A9C12) and check these six locations:

1. Personal Microsoft Accounts (account.microsoft.com/devices/recoverykey)¶

Visit https://account.microsoft.com/devices/recoverykey (poo https://aka.ms/myrecoverykey) i luga o se telefoni po'o se komepiuta lona lua. - Siaki tala fa'asolopito uma: Device Encryption e tua i luga le ki i so'o se Microsoft Account na fa'aaoga muamua ina ua tatalaina le PC, tusa lava pe na e sui mulimuli ane i se saini fa'apitonu'u. Saini i totonu ma su'e uma tuai @hotmail.com, @live.com, @outlook.com, poʻo fesoʻotaʻiga @gmail.com fa'amatalaga, fa'atasi ai ma le tala a so'o se to'alua, matua, po'o se tekinisia na fesoasoani i le setiina o le PC pe saini i totonu o le Microsoft Office po'o le Xbox Game Pass i lena masini.

2. Galuega, A'oga, po'o le Iunivesite Entra ID / Azure AD (myaccount.microsoft.com)¶

E oo lava i luga o se komepiuta feaveai a le tagata lava ia, afai na e saini i totonu o le Microsoft 365 apps (Word, Excel, Teams) ma se ** galuega, iunivesite, poʻo le tuatusi imeli a le tagata o tausia ** ma tuʻu le "Faataga laʻu faʻalapotopotoga e pulea laʻu masini" siaki, e otometi lava ona ave e Windows lau ki o le toe faʻaleleia o BitLocker i totonu o le Microsoft Entra ID o le faalapotopotoga: 1. Visit https://myaccount.microsoft.com/device-list ma saini i lau galuega po'o lau imeli ile aoga. 2. Select your computer name and click View BitLocker keys. 3. Afai ua le atoatoa lau tala ile galuega po'o lau a'oga, vala'au le IT Help Desk a le faalapotopotoga ma avatu ia i latou lau 8-character Key ID. E mafai e le pulega ona toe aumai ki mo fa'amatalaga ua le fa'agaoioia i lalo o le Measini> Masini uma> Fa'afouga ki i entra.microsoft.com.

3. On-Premises Corporate Active Directory (msFVE-RecoveryInformation)¶

If the computer was joined to an Active Directory domain, a Domain Administrator can look up the key by its 8-character Key ID using PowerShell:

Get-ADObject -Filter {objectClass -eq 'msFVE-RecoveryInformation'} -Properties msFVE-RecoveryPassword, whenCreated |
  Where-Object { $_.Name -like "*4F8A9C12*" } | Select-Object Name, msFVE-RecoveryPassword, whenCreated

4. Automated or Manual Text Files on USB Flash Drives and Cloud Drives¶

When Windows saves a recovery key to a file or USB drive, it names the file BitLocker Recovery Key [GUID].txt or saves a hidden .BEK file (attrib +h +s). Run this PowerShell search across all USB drives, external hard drives, OneDrive, Google Drive, and Dropbox folders on another PC:

Get-PSDrive -PSProvider FileSystem | ForEach-Object {
    Get-ChildItem -Path $_.Root -Include "*BitLocker*Recovery*Key*.txt", "*.bek" -Recurse -Force -ErrorAction SilentlyContinue
} | Select-Object FullName, LastWriteTime

5. Extracting the Key for a Secondary Data Drive (D:) from an Unlocked C: Partition¶

If C: boots normally and only a secondary drive D: is locked, open an Administrator PowerShell window on C: and run manage-bde -protectors -get D: to see if C: still holds the auto-unlock registry key, or inspect previous Volume Shadow Copies of your Documents folder for deleted BitLocker Recovery Key *.txt files.

6. Print Spooler History and PDF / OneNote Printouts¶

If you clicked "Print the recovery key" during setup, check Microsoft OneNote and search your Documents folder for .pdf pe .xps files created via "Microsoft Print to PDF".

Track C: Unlocking and decrypting a BitLocker drive from WinRE Command Prompt (manage-bde)¶

If typing the 48-digit recovery password at the blue screen loops back to BitLocker on the next reboot or crashes Windows, unlock and suspend BitLocker from the Windows Recovery Environment (WinRE) Command Prompt:

1. Press Esc at the BitLocker screen, then click Skip this drive -> Troubleshoot -> Advanced options -> Command Prompt.
2. Check status and unlock the OS volume (C:):

   manage-bde -status
   manage-bde -unlock C: -RecoveryPassword 123456-123456-123456-123456-123456-123456-123456-123456
   

   (Or unlock using a binary .BEK file on a USB stick mapped as F: via manage-bde -unlock C: -RecoveryKey "F:\key.BEK").
3. Fa'agata puipuiga ina ia le toe fo'i mai le vave i le isi toe fa'afouina:

   manage-bde -protectors -disable C:
   

   Toe faʻafou ile Windows, ona tamoe lea manage-bde -protectors -enable C: in an elevated Command Prompt to re-seal the Volume Master Key against the new UEFI PCR hashes.
4. If Windows cannot boot, copy files out or fully decrypt:

   robocopy C:\Users\YourUsername F:\RescueBackup /E /ZB /R:1 /W:1 /XJ
   manage-bde -off C:
   

Track D: Mounting a BitLocker SSD on Linux (dislocker / cryptsetup) for file rescue¶

If your Windows motherboard died, place the M.2 NVMe or SATA SSD into an external USB-C enclosure (measuring about 10 centimeters by 3 centimeters, or 4 inches by 1.2 inches) and unlock it on any Linux PC or Ubuntu Live USB:

# Method 1: Modern cryptsetup (v2.3+ natively supports BITLOCKER volumes)
sudo cryptsetup open --type bitlocker /dev/nvme0n1p3 bitlocker_unlocked
# Type the 48-digit recovery key INCLUDING hyphens when prompted
sudo mkdir -p /mnt/windows_data
sudo mount -t ntfs3 -o ro /dev/mapper/bitlocker_unlocked /mnt/windows_data

# Method 2: Using dislocker
sudo apt update && sudo apt install -y dislocker ntfs-3g
sudo mkdir -p /mnt/dislocker_raw /mnt/windows_rescue
sudo dislocker -V /dev/nvme0n1p3 -p123456-123456-123456-123456-123456-123456-123456-123456 -- /mnt/dislocker_raw
sudo mount -t ntfs-3g -o loop,ro /mnt/dislocker_raw/dislocker-file /mnt/windows_rescue

Part 2: Resolving Apple macOS FileVault 2 and Secure Enclave lockouts¶

On macOS (High Sierra through macOS Sequoia and newer), FileVault 2 encrypts the entire APFS (Apple File System) volume. On Macs with Apple Silicon (M1, M2, M3, M4) or the Apple T2 Security Chip, the volume is actually always encrypted at rest using hardware keys inside the Secure Enclave Processor (SEP). Turning on FileVault wraps that hardware Volume Encryption Key (VEK) with a Key Encryption Key (KEK) derived from your macOS login password and your FileVault Recovery Key.

Because FileVault requires decrypting the APFS volume before macOS loads from disk, the first screen you see when you turn on a FileVault-enabled Mac is not the normal macOS login window, it is the pre-boot FileVault EFI / iBoot unlock screen.

Step 1: Rule out the #1 cause of sudden FileVault lockouts (Pre-boot keyboard layout & external keyboards)¶

Before assuming your password broke or starting a reset, check these three pre-boot quirks that cause valid passwords to shake and reject at the FileVault boot screen:

1. Pre-boot Keyboard Input Menu Switch: The pre-boot FileVault screen uses a stripped-down firmware keyboard driver that frequently defaults to U.S. QWERTY (or ABC) even if you typed your password using a UK, German (QWERTZ), French (AZERTY), or Dvorak layout inside macOS. Look at the top-right corner of the FileVault login screen, click the Keyboard Input menu icon, and select your exact keyboard layout.
2. Bluetooth Keyboard Timing & Num Lock: Third-party Bluetooth keyboards often drop their first two keystrokes while waking up at the pre-boot screen, or lack Num Lock state indicators. Plug a wired USB keyboard directly into the Mac (or use the built-in MacBook keyboard) and type slowly.
3. Multiple Admin Users on the Same Mac: In FileVault, each authorized macOS user account has its own independent cryptographic token in the APFS Key Bag (diskutil apfs listCryptoUsers /). If your account shakes and fails, click ** another Administrator user icon** on the FileVault screen and log in with their password. Once inside macOS, that admin can reset your password in System Settings > Users & Groups.

Step 2: Unlocking FileVault via Apple Account (iCloud) or 24-Character Personal Recovery Key¶

If your password still fails at the FileVault login screen:

1. Wait for the Recovery Prompt: After typing an incorrect password three times at the FileVault login screen, macOS displays options to reset using your Apple Account or enter your Recovery Key.
2. Or boot directly into macOS Recovery (Recovery Assistant):
3. Apple Silicon Macs (M1/M2/M3/M4): Shut down completely, then press and hold the Power (Touch ID) button for 10 seconds until "Loading startup options..." appears, click Options, and click Continue.
4. Intel Macs: Turn on the Mac and hold Command (⌘) + R until the Apple logo appears.
5. Inside the Reset Password Recovery Assistant window:
6. Connect to Wi-Fi in the top-right corner of the screen or plug in Ethernet.
7. Option A (Apple Account Escrow): If you enabled iCloud recovery, select Forgot all passwords? -> Sign in with Apple Account. Enter your Apple Account email, password, and 6-digit 2FA code (if you lost your phone, see our loka MFA ma toe fa'amaonia guide) to unlock the APFS volume and set a new password.
8. Option B (24-Character Personal Recovery Key): Select Enter FileVault Recovery Key and type your 24-character alphanumeric code (XXXX-XXXX-XXXX-XXXX-XXXX-XXXX).
9. Option C (Corporate / University MDM Escrow): If your Mac is managed via Jamf Pro, Kandji, Mosyle, or Microsoft Intune, call your IT Help Desk with your Mac's serial number so they can read you the escrowed 24-character FileVault Recovery Key.

Step 3: Unlocking a FileVault APFS volume manually from Terminal (diskutil apfs unlockVolume)¶

If the graphical Recovery Assistant fails to mount your drive, open Utilities -> Terminal inside macOS Recovery and unlock the APFS volume manually:

# 1. List all APFS containers and encrypted volumes to find the Volume Identifier (e.g., disk3s5)
diskutil apfs list

# 2. List all cryptographic users (UUIDs) authorized to unlock that APFS volume
diskutil apfs listCryptoUsers /dev/disk3s5

# 3. Unlock the APFS volume using either your user password OR your 24-character Recovery Key:
diskutil apfs unlockVolume /dev/disk3s5 -passphrase "YOUR-XXXX-XXXX-XXXX-XXXX-XXXX-KEY"

# 4. Copy critical files from '/Volumes/Macintosh HD - Data' to an external USB drive:
cp -Rv "/Volumes/Macintosh HD - Data/Users/yourusername/Documents" "/Volumes/ExternalUSB/Backup/"

Part 3: Resolving Linux LUKS (dm-crypt / cryptsetup) encryption lockouts¶

Linux distributions (Ubuntu, Fedora, Debian, Arch Linux, Red Hat Enterprise Linux, Pop._OS, and Qubes OS) rely on LUKS (Linux Unified Key Setup), typically LUKS2, managed by cryptsetup ma dm-crypt. When a Linux machine drops into an (initramfs) pe dracut shell saying cryptsetup failed, bad password or options, follow these four steps:

Step 1: Check console keymap vs graphical keyboard layout¶

During the pre-boot initramfs phase, the system uses the Linux console keymap (/etc/vconsole.conf), which often defaults to us even if you configured a UK, German, French, or custom programmer layout inside GNOME or KDE. Boot a Linux Live USB, open a graphical terminal where you can type your passphrase visibly in a text editor to verify every character, and unlock the drive from the Live USB:

lsblk -f
sudo cryptsetup luksOpen /dev/nvme0n1p3 my_encrypted_root

Step 2: Inspect the LUKS header and check secondary keyslots (cryptsetup luksDump)¶

LUKS1 supports 8 independent Keyslots (0 to 7) and LUKS2 supports up to 32 Keyslots (0 to 31), plus hardware Tokens (systemd-tpm2 pe systemd-fido2). Inspect your header without changing anything on disk:

sudo cryptsetup luksDump /dev/nvme0n1p3

sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7 /dev/nvme0n1p3

Step 3: Recovering from a corrupted or overwritten LUKS2 header¶

In LUKS, all keyslots live in the first 2 megabytes (LUKS1) or 16 megabytes (LUKS2) of the partition. If cryptsetup luksDump says not a valid LUKS device, take these steps:

1. Image the first 32 MB before touching anything:

   sudo dd if=/dev/nvme0n1p3 of=~/damaged_luks_first32mb.img bs=1M count=32 status=progress
   

2. Attempt automatic LUKS2 secondary JSON metadata repair (cryptsetup repair):
3. LUKS2 stores two redundant copies of the binary and JSON header metadata at offset 0x0000 and offset 0x4000 (16 KB). If only the primary copy at byte 0 was clobbered, sudo cryptsetup repair /dev/nvme0n1p3 reconstructs it from 0x4000.
4. Restore from a saved LUKS Header Backup (luksHeaderRestore):
5. Unlock non-destructively using an external header backup file:

   sudo cryptsetup luksOpen --header /path/to/luks-header.bak /dev/nvme0n1p3 rescued_volume
   

Step 4: Testing partially remembered passphrases with hashcat¶

While you cannot brute-force a random 48-digit BitLocker Recovery Key or 24-character Apple Recovery Key (\(2^{128}\) bits of entropy), you can test variations of a human-chosen LUKS passphrase or BitLocker custom user password if you remember the base words:

# For Linux LUKS2 (mode 29500) or LUKS1 (mode 14600):
sudo dd if=/dev/nvme0n1p3 of=luks_header.bin bs=1M count=16
hashcat -m 29500 luks_header.bin my_candidate_words.txt -r /usr/share/hashcat/rules/best64.rule

# For BitLocker protected by a custom User Password (mode 22100):
bitlocker2john -i /dev/nvme0n1p3 | grep "\$bitlocker\$0\$" > user_pass.hash
hashcat -m 22100 user_pass.hash my_candidate_words.txt -r /usr/share/hashcat/rules/best64.rule

Prevention: How to build a lockout-proof disk encryption backup right now¶

The moment you regain access to your computer (or on every other computer you own today), spend five minutes executing these commands so a motherboard failure or firmware update can never trap your files again:

1. On Windows (Export your BitLocker Recovery Key & pause before BIOS updates)¶

Open an Administrator PowerShell or Command Prompt and export your current 48-digit recovery password:

# Display all BitLocker recovery keys and Key IDs across all drives
Get-BitLockerVolume | Select-Object MountPoint, VolumeStatus, -ExpandProperty KeyProtector |
  Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' } |
  Select-Object MountPoint, KeyProtectorId, RecoveryPassword

2. On macOS (Verify or rotate your FileVault Recovery Key)¶

Open Terminal and check who is authorized to unlock your APFS startup disk:

sudo fdesetup status
diskutil apfs listCryptoUsers /

sudo fdesetup changerecovery -personal

3. On Linux (Back up your LUKS header and enroll a fallback Keyslot)¶

Always keep a copy of your 16-megabyte LUKS header on an external USB thumb drive and enroll a printed 64-character recovery passphrase into Keyslot 1:

# 1. Back up the binary LUKS header to an external USB drive
sudo cryptsetup luksHeaderBackup /dev/nvme0n1p3 --header-backup-file /media/usb/luks-header-nvme0n1p3.bak

# 2. Add an independent emergency recovery passphrase into Keyslot 1
sudo cryptsetup luksAddKey --key-slot 1 /dev/nvme0n1p3

Encryption emergency readiness checklist¶

• Export your 48-digit BitLocker Recovery Key (including its 8-character Key ID) and store it inside your password manager and printed on paper inside a fireproof safe at least 1.5 meters (5 feet) above floor level.
• Print or save your 24-character macOS FileVault Recovery Key alongside your Apple Account 28-character recovery key.
• Back up your 16-megabyte Linux LUKS header (cryptsetup luksHeaderBackup) to an offline USB drive so an accidental partition overwrite cannot destroy all keyslots.
• Maintain an independent, automated 3-2-1 computer backup so that even a catastrophic SSD controller death or forgotten encryption key never destroys your irreplaceable photos, tax documents, or source code.

Fesili e fai soo¶

Taiala fa'atatau¶

• Windows Blue Screen (BSOD) ma le fa'aleleia o seevae
• macOS kernel panic, black screen, and recovery
• Fa'aletonu le ta'avale a le Linux ma le toe fa'aleleia o le GRUB
• Loka le pule o upu fa'apolokalame ma le toe fa'aleleia o vault fa'afuase'i
• Fa'aletonu le ta'avale malo ma le toe fa'aleleia o fa'amaumauga
• Computer backups: 3-2-1 strategy and disaster recovery
• Fa'atonu numera o fa'alavelave

Punavai ua siaki¶

• National Institute of Standards and Technology (NIST) (United States): NIST Special Publication 800-111: Guide to Storage Encryption Technologies for End User Devices & FIPS 197 (AES-XTS).
• Microsoft Learn Official Documentation: BitLocker Recovery Overview, TPM Platform Configuration Registers (PCR 0-11) Validation Profile, and manage-bde Command-Line Reference.
• Apple Platform Security Guide: Volume Encryption with FileVault, APFS Key Bags, Secure Enclave Hardware Root of Trust, and Institutional/Personal Recovery Key Escrow. -Trusted Computing Group (TCG) (International): TPM 2.0 Library Specification and PC Client Platform Firmware Profile Specification.
• GitLab Cryptsetup / LUKS2 Official Specification: LUKS2 On-Disk Format Specification, Argon2id PBKDF Memory-Hard Keyslots, and Header Backup/Repair Procedures.