BitLocker Manual Partition Unlock via Command Line

Hello,

You’re in a situation where BitLocker is doing exactly what it was designed to do: each encrypted volume has its own recovery key, and unlocking one partition doesn’t automatically give you access to the others. The text file you found with a numeric password and an External Key ID is important, but you can’t “bypass” the BitLocker prompt—Windows only accepts valid recovery keys or passwords that match the volume’s protector.

Here’s how you can use what you have. If the numeric string in that file is a 48‑digit recovery password, you can feed it directly into BitLocker. In PowerShell, run:

Mã

manage-bde -unlock E: -RecoveryPassword 123456-123456-123456-123456-123456-123456-123456-123456

Replace E: with the actual drive letter assigned to the data volume, and replace the digits with the exact 48‑digit password from your file. That is the supported way to unlock using a recovery password.

If instead the file contains an External Key ID but not the full recovery password, that ID is only a reference pointer. It tells you which recovery key file (.BEK) or record in Azure AD/Microsoft Account corresponds to that volume. You cannot unlock with the ID alone. You would need the actual .BEK file (commonly stored on a USB drive during setup) or the 48‑digit recovery password associated with that ID. Without the full key, Windows will not unlock the volume.

So the immediate step is to confirm whether the numeric string you have is indeed the 48‑digit recovery password. If it is, use manage-bde as shown above. If it’s only an identifier, you’ll need to locate the corresponding recovery key file or check again in your organization’s Azure AD portal under Devices > BitLocker keys for that specific volume.

There is no supported command to bypass BitLocker with just an ID. Either the recovery password or the external key file must be present. If you can’t locate the actual key, the data volume will remain inaccessible.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

Domic Vo.

Use the BitLocker command-line tools to unlock that secondary data volume with the credentials in the text file.

Assumptions based on what is available:

• The drive is attached to the workstation as, for example, D:.
• The text file contains either:
  • a 48‑digit numeric recovery password, and/or
  • an External Key ID that corresponds to a .bek key file (recovery key) you have.

1. Unlock with the 48‑digit numeric recovery password

If the “numeric password” in the file is the standard 48‑digit BitLocker recovery password (8 groups of 6 digits separated by hyphens), use manage-bde directly:

manage-bde.exe -unlock D: -recoverypassword xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx

Replace D: with the actual drive letter and the x groups with the exact 48‑digit value from the text file.

If successful, the volume will unlock and be accessible in File Explorer. If needed, you can then turn BitLocker off or copy the data out immediately.

2. Unlock with an external recovery key (.bek) file

If the text file’s “External Key ID” corresponds to a BitLocker recovery key file you have (a .bek file, usually named like {GUID}.bek), use:

manage-bde.exe -unlock D: -recoverykey E:\path\to\{protector_id}.bek

Where:

• D: is the BitLocker data volume.
• E:\path\to\{protector_id}.bek is the full path to the .bek file on whatever drive holds it.

3. If the drive is attached as a secondary disk and you prefer PowerShell

If the workstation is running Windows with the BitLocker module available, PowerShell can also unlock with the recovery password:

Unlock-BitLocker -MountPoint D -RecoveryPassword xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx

Again, replace D and the password with the actual values.

4. If the “numeric password” is not in 48‑digit recovery format

BitLocker recovery via command line requires one of the supported protectors:

• 48‑digit recovery password (-recoverypassword), or
• recovery key file (.bek, via -recoverykey), or
• a Data Recovery Agent certificate (-certificate) if configured in the environment.

If the numeric value in the file is not a valid 48‑digit recovery password and there is no matching .bek file or DRA, it cannot be used to unlock the drive. BitLocker is designed so that without a valid recovery password, recovery key, or DRA, the data is not recoverable.

Once the drive is unlocked, copy the required spreadsheets off immediately to a safe location.

References:

• manage-bde unlock
• BitLocker operations guide
• BitLocker recovery overview
• BitLocker recovery process
• BitLocker FAQ
• Find your BitLocker recovery key