In your case key is not empty. Solution with "clear key" won't work.
Ask your client about his Microsoft account.
Specify model of your ThinkPad laptop.

_________________
Angel Data Recovery

Thank you so much DR-Kiev . Customer is not having microsoft account so even that option is cannot be used.
I think recovery will not be possible in this case.
How particular numeric key is assigned or key is created when customer is saying he has not done anything and he is not even aware of Bitlocker.

Is it anyway possible to access TPM & extract key from TPM ?

In case you wanted to try

https://github.com/SySS-Research/icesti ... pm-sniffer

https://www.youtube.com/watch?v=-Fj3SeZww3M

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein

Did use LPC sniffing in a BitLocker TPM-only mode case. SSD had a lot of reading errors, windows could not boot but TPM still unlocking the drive.
Sniffing worked fine and VMK was found and used in DE to decrypt. In this case it was useful to get the SSD moved to DE for imaging. Could probably have used a live CD to boot the pc and made a image that way, but without power control imaging would not have been successful. Drive hang itself on every reading error.

In your case terminator2, as i understand it, TPM is not decrypting the drive and there is no "clear key" in meta. To sniff VMK TPM encryption needs to work, so i cant see how sniffing will solve your case.

_________________
Digitalsupport Data Recovery
https://digitalsupport.dk

Wo great explanation digisupport .
Thanks a lot for logically explaining this mechanisam.

Hi Guys
I have been reading various articles regarding Bitlocker and I have read that there are many triggers which can provoke Bitlocker pop up asking to enter key . Some of them are harmless like - 1) updating Bios 2) Changing keyboard type 3) changes in Bios settings etc.
In this case protectors are TPM+PIN ,
I just want to know whether both TPM and key must be present (Recovery is only possible from original laptop and all combinations of protectors must be present for decryption)
In that case working on only hard disk may not be of any use. I think if correct password is entered then only Key from TPM is fetched.
Also in such cases if original laptop is missing or is damaged then recovery be impossible altogether.
Those who have done research on bitlocker pls. help.

Hi,
If the required key can be sniffed (i.e. LPC communication is not encrypted) then it should be possible to be extracted by booting a linux and accessing TPM with trousers/tpm-tools (in case secure boot is not enabled). If it's still not working, then you can still try to throw the windows installation under a virtual machine which emulates the TPM, so you can basically sniff the TPM in a 'soft' way, without having to actually solder wires on TPM chip.

hi alpy
thanks a lot , at least I come to know there is way out. I will give it a try.Unfortunately customer is not having microsoft account so no backup is present.