Reference BitLocker Frequently Asked Questions (FAQ):
If I lose my recovery information, will the BitLocker-protected data be unrecoverable?
BitLocker is designed to make the encrypted drive unrecoverable
without the required authentication. When in recovery mode, the user
needs the recovery password or recovery key to unlock the encrypted
drive. Therefore, we highly recommend that you either store the
recovery information in AD DS, along with your Microsoft account
online, or another safe location.
See Unlock a BitLocker-protected drive for instuctions on unlocking the different kinds of drive (system, data, or removeable) using your password.
To prevent losing access to BitLocker-protected drives in the event of
TPM failure, forgotten passwords, or loss of smart cards or USB keys,
it is important that you have a means for administrators to get access
to BitLocker drives. BitLocker supports the following methods to
recover access to protected drives:
Recovery key or recovery password. You can use a recovery key or a recovery password with BitLocker. If a BitLocker key is unavailable,
such as in the case of a missing smart card or forgotten user
password, a 48-digit recovery password can be used to unlock the
protected drive. In place of a password, a recovery key that has been
stored to a file on removable media, such as a USB flash drive, can
also be used to unlock the protected drive.
Backup of keys to Active Directory Domain Services. BitLocker recovery passwords can be stored in Active Directory Domain Services.
This allows administrators, such as help desk staff, to assist users
in recovering BitLocker-protected drives when they have forgotten or
misplaced their recovery password.
Data recovery agent. A data recovery agent is a designated person, such as a system administrator, who can use his or her administrative
credentials to unlock BitLocker-protected drives. BitLocker is not
configured with default data recovery agents, nor are data recovery
agents enabled by default. They must be enabled and configured by
using Group Policy.