Service Description
Who is this service for?
This service is only available for UK based organisations. It is not available to private individuals. Your organisation must be the owner of the laptop and data it holds or be in law enforcement. The service is only a practical option when the value of data on the laptop far exceeds the value of the laptop itself.
How do we get started?
During the project initiation phase we ask about the laptop, identify the type of encryption, explain the risks and chances of success, your requirement to access it's data, and discuss how you would like the recovered data returned. Clients with high security or chain of custody requirements may request the work is performed on their own premises.
Data Recovery
We use a combination of electronics and cyber security tools and techniques to gain access to the laptop. We exploit vulnerabilities that are often incorrectly thought of as impractical.
What Happens Project Conclusion
The laptop and any recovered data will be returned to you through means pre-agreed. A short report describing how the data was recovered will be provided.
What are the chances of success?
As different configurations of bitlocker and models of laptops have widely different levels of security, the chance of success can vary significantly. We'll discuss this with you, but the following flow chart shows may give you an indication.
FAQ About this Service
Can you really decrypt BitLocker?
Many of our clients are initially sceptical that laptops encrypted with BitLocker can be decrypted. That sceptism isn’t entirely misplaced, BitLocker can provide excellent data-at-rest encryption. However, the strength of that protection depends on the configuration of BitLocker.
The most common configuration is TPM Only mode, and in this mode we are able to gain access to the laptop in most instances. Another instance in which we can help is if the laptop is in TPM+PIN mode, and the PIN is known but the following Windows login credentials are not. In this scenario, the laptops are vulnerable to hardware attacks.
We can also attempt crack the PIN where the TPM has not been enabled, doesn't have a TPM, or used for BitLocker volumes designed to be shared across computers (e.g. a BitLockered USB Flash Drive).