What to do if…
your device suddenly asks for a disk-encryption recovery key after a restart

What to do now

1. Check whether this is the real device recovery screen.

   • A genuine BitLocker or FileVault prompt is usually part of the startup or login flow, before you can fully sign in.
   • It should not be a normal browser page asking you to type the key into a website.
   • If the screen tells you to visit a strange website, scan a QR code, pay money, contact a stranger, or use an online chat, stop and use another trusted device to get help.

2. Record exactly what the screen says.

   • Take a clear photo of the whole screen.
   • Include any Key ID, recovery key ID, device name, serial number, or exact wording.
   • Write down what happened just before this started, such as a Windows update, BIOS or firmware update, repair, docking station change, password change, or account change.

3. Work out which recovery route fits the screen.

   • Windows: the screen often says “BitLocker recovery key” and shows a Key ID or recovery key ID.
   • Mac: the screen may mention FileVault, the startup disk, an Apple Account, or a recovery key.
   • Work, school, or managed device: contact the organisation’s IT helpdesk before trying resets or recovery tools.

4. If it is Windows or BitLocker, look for the matching key safely.

   • On a separate trusted device, sign in to the Microsoft account used on that PC and look for the BitLocker recovery key that matches the Key ID shown on screen.
   • If the PC has ever used a work or school account, check that account’s device page or contact the organisation’s IT helpdesk; they may need the Key ID.
   • Check places where you may have saved the key: a printed copy, password manager secure note, USB drive, recovery-key file, or device paperwork.

5. Know the BitLocker limit before you spend hours searching.

   • Microsoft Support generally cannot retrieve, provide, or recreate a lost BitLocker recovery key.
   • If you cannot find the key through your account, organisation, printout, USB drive, or saved records, resetting the device may be the remaining route and can remove your files.

6. If it is a Mac or FileVault prompt, use the recovery method that was set up for that Mac.

   • If you chose Apple Account recovery, follow the on-screen Apple Account route.
   • If you created a FileVault recovery key, retrieve it from where you stored it, such as paper, a secure note, or a password manager.
   • The FileVault recovery key may be visible in the Passwords app on your Mac, or on an iPhone or iPad signed in to the same Apple Account.
   • If the Mac is managed by work or school, ask IT or the administrator for help before trying to erase or reinstall macOS.

7. If this followed a BIOS, firmware, security, or hardware change, treat it as plausible but still be careful.

   • BitLocker can ask for a recovery key after some security or hardware changes.
   • That does not by itself prove the device has been hacked.
   • Continue using only the official account, Apple, Microsoft, or IT recovery routes.

8. If you see signs of fraud or compromise, reduce exposure while you recover access.

   • If you can do so without losing access or interrupting IT instructions, disconnect Wi-Fi or Ethernet while you investigate.
   • Do not contact numbers or links shown in unexpected messages.
   • After you regain access, or from a separate trusted device if accounts may be at risk, change important passwords starting with email and run a reputable security scan.

9. Report only if there are signs of cybercrime, fraud, or immediate risk.

   • For England, Wales, or Northern Ireland, use Report Fraud for fraud or cybercrime reports.
   • If you live in Scotland or the incident happened there, contact Police Scotland on 101 for non-emergency reporting.
   • If someone is in immediate danger, a crime is happening now, or urgent police help is needed, call 999.