How to unlock a BitLocker-locked drive

A BitLocker-locked drive demands a password, a USB key file, or the 48-digit recovery key before it shows any files. Unlock with what you have, find the key in your Microsoft account if you do not have it, and copy your files off before you decrypt the drive clean.

Written by Essential Data RecoveryPublished 2026-09-13Owner-reviewedRevision 1

A closed portable drive with a brass key resting against it and a folded blank paper note on pale oak wood

A BitLocker-locked drive will not show you a single file until it gets a key. Windows puts up a BitLocker recovery screen, in the boot manager before Windows starts or inside the recovery environment, and that screen asks for the recovery key. Unlocking is the safe part: supplying the right password or key changes nothing on the disk, it only makes the contents readable. The step that writes to the drive is decryption, so this guide holds that step until last, after your files are copied somewhere else.^[1]

What locked looks like, and why it locked

A locked BitLocker drive announces itself: Windows shows a recovery screen and asks you to enter the recovery key, either before Windows starts or inside Windows Recovery Environment. For a data or removable drive the same demand meets you when you connect it or try to open it, and the Control Panel BitLocker applet is one place you can answer it. (A padlock icon in File Explorer is a common tell, though general observation rather than documented behavior.) The lock usually has a nameable cause: BitLocker puts a drive into recovery mode after events like entering the wrong PIN too many times, a BIOS or UEFI firmware upgrade, moving the drive into a new computer, or too many failed sign-in attempts. That covers the classic case, an external drive that worked in an old laptop and refuses to open in a new one, and it explains why your everyday password may be refused: in recovery mode, only the recovery password or recovery key counts.^[1]

Unlock with the password or USB key

If the drive asks for a password and you know it, this is the short path. Two key types turn up here: the recovery key proper is an encryption key stored on removable media as a file with a .bek ending, and it unlocks fixed and removable drives when the password is forgotten or cannot be used. Microsoft documents two routes into a data or removable drive, the Control Panel applet and the command line, and positions manage-bde as a full alternative to the applet, so each step below has a windowed and a typed version.^[2][1]

Unlock a data or removable drive with what you have

Connect the drive, then open Control Panel and choose BitLocker Drive Encryption.
Choose Unlock drive for the locked drive.
Supply the recovery password, or point at the recovery key file: both are accepted for data and removable drives.
If the drive is protected by a USB key file, plug that stick in first; the file is named for its protector ID and ends in .bek.
Enter the 48-digit recovery password as eight groups of six digits, dashes included, exactly as saved.
If typing fails, copy and paste the number instead of retyping it.
If the drive opens, skip ahead to copying your files off. Do not format, decrypt, or reset anything yet.
If the applet rejects the number, or Windows keeps demanding a key you do not have, go to the key-finding section below.

^[3][1]

Unlock with the 48-digit recovery key

When a drive is in recovery mode it wants the recovery password: a 48-digit number used to unlock a volume in recovery mode, entered either in the Control Panel applet above or via manage-bde -unlock in an administrator command prompt.^[1]

The command-line route is manage-bde -unlock. Microsoft's documented syntax, quoted exactly, is 'manage-bde -unlock {-recoverypassword -password | -recoverykey <pathtoexternalkeyfile>} <drive>' plus optional parameters. In plain terms: name the drive letter, then either a recovery password or a path to a recovery key file. The '-password' after -recoverypassword is a placeholder for the number itself; a bare -password switch instead makes the tool prompt you for the password interactively. Microsoft's examples use drive E, so substitute your drive's letter.^[3]

Unlock from the command line

Open Command Prompt as administrator: search for cmd, right-click it, and choose Run as administrator.
To unlock with a password you know, type 'manage-bde -unlock E: -password', using your drive's letter; the tool then prompts you for it.
To unlock with the 48-digit recovery password, type 'manage-bde -unlock E: -recoverypassword xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx', replacing the placeholder groups with your number, dashes included exactly as saved.
To unlock with a recovery key file, type 'manage-bde -unlock E: -recoverykey F:\Backupkeys\recoverykey.bek', using your own path to the .bek file.
If the command reports no matching key protector, or the unlock fails, stop: the number you have is probably for a different drive or an earlier encryption. Go to the next section.

^[3]

Where the recovery key lives

If you never saved a key on purpose, one may still exist. For devices not joined to a work or school directory, storing the recovery key in your Microsoft account is Microsoft's default recommended storage method, so that is the first place to look. Keys also end up in a few other documented places: saved as a text file or printed on paper, held in Microsoft Entra ID or Active Directory on a managed computer, or a .bek file on a USB stick.^[1]

Find the key in your Microsoft account

Sign in to your Microsoft account, on another device if the locked computer is your only one.
In the navigation header at the top of the page, select Devices.
Select See details under the device that is locked.
Under BitLocker data protection, select Manage recovery keys.
Locate the device, select the recovery key, and press Ctrl+C to copy it.
Take the number to the locked computer and use either unlock route above.

^[4]

If the locked computer belongs to an employer or school, do not conclude the key is gone after a personal-account search: a recovery password can be stored in Microsoft Entra ID or Active Directory, where administrators can retrieve a copy you cannot see. Asking IT is cheaper than writing the drive off.^[1]

After it unlocks: copy first, decrypt second

Unlocking only makes the data readable. Decryption is different: 'manage-bde off' decrypts the drive, turns BitLocker off, and removes all key protectors when it finishes, rewriting the volume in place, which can take a long time on a large disk. Copy your files to another drive and confirm the copies open before you decrypt anything. If the drive has any underlying hardware trouble, you want the data elsewhere before a full rewrite.^[2]

Turn BitLocker off once your files are safe

Copy the folders you care about to another drive, then open a few of the copied files to confirm they are intact.
If your goal was only to read the files, stop here: there is no need to decrypt a working drive.
Open Command Prompt as administrator, type 'manage-bde -off E:' with your drive's letter, and press Enter.
Let decryption run to completion; key protectors are removed only when it finishes.
Prefer windows to commands? The BitLocker Drive Encryption Control Panel item does the same job: Microsoft documents manage-bde as a full alternative to it.

^[2]

BitLocker To Go on removable drives

Removable drives encrypted with BitLocker, long sold under the BitLocker To Go name, unlock the same way as fixed drives: recovery password or recovery key in the Control Panel applet, or manage-bde -unlock against the drive letter. One difference matters for key storage: Microsoft notes there is no automatic way to store a removable drive's recovery key in Microsoft Entra ID or AD DS, so on a personal device the key lives only wherever you saved it at encryption time.^[1]

If you have no key at all

Without the recovery password or the recovery key, the data on a BitLocker-protected drive is out of reach. Even the deepest mechanism Microsoft documents, the key package used with the BitLocker Repair tool, decrypts portions of a corrupted drive only when combined with the recovery password or recovery key, so there is no Microsoft-provided decryption path that works without the key. The encryption is not bypassable: no legitimate service or software can decrypt the drive without it, and a third-party product advertising key-free BitLocker recovery should not be trusted with your drive. Work through every storage location above before treating the data as lost, and ask IT about work machines.^[1]