On this page
BitLocker is Windows drive encryption. It protects data so somebody who removes or starts the disk outside its trusted setup cannot read it without the key. Device Encryption is a simpler Windows feature built on the same protection and is often enabled automatically on supported devices.
A BitLocker recovery key is a unique 48-digit number that can unlock the encrypted drive when normal automatic unlocking fails. It is different from the password or PIN used to sign in to Windows.
Why a firmware change can request the recovery key
On many protected computers, Windows normally unlocks the system drive after it recognizes the expected hardware and startup state. The learner may never type the 48-digit recovery key during an ordinary startup.
A storage-controller or firmware change can alter that expected state. Windows may then show a BitLocker recovery screen because it cannot confirm that the change was authorized.
That screen does not by itself mean the files are lost. It means Windows needs the matching recovery key before it can continue. This is why you retrieve and verify the key before changing RST, VMD, RAID, AHCI, Secure Boot, or other relevant firmware settings.
Why Ubuntu cares about Windows encryption
If Ubuntu will share a disk with Windows, the installer must understand the existing layout and find a safe place for Ubuntu without damaging encrypted Windows data.
With Ubuntu 26.04, one computer may show a supported Install Alongside choice while another shows a BitLocker alert or no alongside choice.
Canonical’s release notes describe alongside support for some existing BitLocker layouts when suitable space is available. Its installation guide also explains that installation is blocked when the installer cannot safely use the encrypted layout it sees.
The difference is evidence about the actual disk layout—not permission to guess. Read the message and final disk summary shown on this computer.
Decide whether Windows must remain
If Windows will be erased
BitLocker does not need to be turned off merely so Ubuntu can erase the entire selected disk. The erasure removes Windows, its encrypted data, and the disk layout together.
Every wanted file must already exist in a verified backup. Complete-disk erase is destructive, and recovery is not promised.
If Windows must stay on the same disk
Preserve the recovery key and file backup first. Then use the exact installer choice and Canonical procedure that match the screen you see.
If the installer displays the BitLocker blocker or cannot offer a safe guided layout, return to Windows. Do not create a new partition table or delete encrypted partitions to force the alongside option to appear.
If Ubuntu will use a separate physical disk
A separate unencrypted physical disk can be another supported arrangement. You must still identify both drives correctly and preserve Windows recovery information. “Separate disk” means another storage device, not another partition on the same device.
Find and back up the recovery key
Microsoft documents several possible key locations:
- A personal Microsoft account.
- A work or school account for a managed device.
- A USB flash drive, file, or printout chosen when protection was enabled.
- The organization’s administrator for managed equipment.
Open Windows Manage BitLocker and use Back up your recovery key for the protected drive. Confirm that the saved copy can be accessed without relying on the encrypted computer.
Microsoft recommends not keeping a printed or USB copy beside the protected device, because anyone with both could bypass the protection.
Microsoft Support cannot recreate a lost key. If a work or school account controls it, stop and contact the administrator.
Prepare Windows for same-disk dual boot
BitLocker preparation sequence
- Confirm in writing that Windows must be preserved.
- Back up personal files to another device or service.
- Verify that the BitLocker recovery key is accessible.
- Create an additional key backup when appropriate and store it away from the computer.
If the installer displays the BitLocker blocker or the guided alongside choice is unavailable, follow Canonical’s current Turn off BitLocker in Windows procedure.
- Wait until Windows reports that decryption is complete.
- Restart Windows and confirm that it boots and files open normally.
- Return to the Ubuntu live session and verify the internal disk before opening disk setup.
Canonical’s current turn-off instructions use the Windows BitLocker management interface and require waiting for decryption to finish.
Here, turn off means decrypt the Windows data through the supported Windows process. It does not mean delete the encrypted partition. Decryption preserves readable Windows files; deleting the partition destroys its structure.
If Ubuntu 26.04 already offers a supported alongside plan and its final summary preserves the correct Windows partitions, do not turn encryption off merely from habit. Follow the current installer and documentation for the choice actually shown.
Why Install Alongside may be missing
Verified causes and conditions include:
- The installer detects a BitLocker layout it cannot safely use for the requested alongside plan.
- The internal drive is not accessible because of an RST or controller conflict.
- There is no suitable visible operating-system layout or available space for the guided choice.
- The installer is looking at only the USB rather than the internal disk.
The last two depend on the actual disk state. They are possibilities, not a diagnosis from the missing button alone. Do not create a new partition table to make the option appear. First check BitLocker status, internal-drive visibility, and the exact installer message.
Ubuntu 26.04 includes improved BitLocker dual-boot possibilities, but those do not make encrypted Windows files generally readable to Ubuntu. Use the visible options and final disk summary for the exact configuration rather than assuming the improvement removes every encryption boundary.
Common mistakes and recovery
Suspending protection instead of decrypting when Canonical requires turning it off. These are different states. Follow the maintained procedure and wait for completion.
Saving the recovery key only on the same computer. A key stored only inside the disk it must recover may be unreachable when needed.
Changing AHCI first and looking for the key later. Retrieve the key while Windows starts normally.
Deleting the Windows partition because Install Alongside is absent. That is not a dual-boot fix; it removes Windows data and recovery structure.
Assuming Device Encryption is off because “BitLocker” was never configured manually. Microsoft says Device Encryption can be enabled automatically. Check its actual status.
If a recovery screen appears, use the key ID shown on screen to choose the matching stored recovery key. Do not erase or reinstall while a valid recovery route remains.
Practice
Knowledge check
Choose the safe next step. Explain the difference between a Windows account password and a BitLocker recovery key. Then name the rule for same-disk dual boot: preserve the key and files, complete the official decryption procedure when it is required, verify Windows, and only then return to Ubuntu.
What to learn next
Continue to Ubuntu Installation Options Explained after Windows and storage checks pass. If the SSD is still absent, return to the RST, VMD, RAID, and AHCI lesson instead of opening disk setup.