Here’s a story (not very short) about an encounter I had recently. I sent a semi-annual invoice to a client, and his partner called me to inform me my client had passed away. The survivor’s partner (I’ll call him Jim) was not interested in keeping the SPF+ subscription. I said that I would have to remotely connect to the computer to uninstall everything and close the account. This is a normal offboarding procedure, and I have done it many times. In this case, things did not go as I had planned.
Shortly after rebooting the computer for the final time, Jim called to say he could no longer log in using the known password. He said Windows did not recognize it. I looked in my files and confirmed that what I had used less than an hour earlier was identical to what Jim used. I asked the Network Operations Center for any reason why this would be the case after removing my remote monitoring software. They indicated there is absolutely nothing in their software (especially after removal) that would cause this to occur.
So here is problem number one. My client, the decedent, was using a Microsoft account. When I originally delivered his computer, I configured it with a local Windows account. At some point afterward, he converted it to a Microsoft account using his AOL email address. This change shifted credential control from the local PC to Microsoft’s cloud authentication systems.
The primary difference between the two types of accounts is that the former account resides on the computer, and you can access it without an internet connection. The latter requires an internet connection, and Microsoft safeguards the account information. That controlling aspect is what prevented me – and Jim – from accessing the computer now.
Microsoft’s website for account administration (https://account.microsoft.com) has three options to log in:
- Use your face, fingerprint, PIN, or security key
- Use your password
- Send a code to the known AOL email account
My attempts to recover this failing Microsoft account password required knowledge of, or access to, the following:
Base email account the AOL email account
Text message on phone *** **–*87
The phone number ending in 87 is a landline, which (obviously) does not receive text messages. I can only surmise that my client never updated his Microsoft account to provide a cell phone number. Keep reading to find out why I cannot access the AOL email account.
Problem number two is that Windows BitLocker protects the computer from unauthorized use. I tried to access Windows in “Safe Mode,” which offers methods to help me reset the password for the Microsoft account, or, failing that, to establish a new local account to access the computer’s contents. The Recovery screen was unresponsive when I used the wireless keyboard and mouse. It also failed when I used a wired keyboard and mouse.
I then attempted to use a separate Windows recovery tool by booting from a USB drive to access the hard drive, but access was blocked immediately by a prompt for a BitLocker key. At some point, my client enabled Windows’ built-in BitLocker encryption. During that process, Windows generates a 48-digit numerical sequence. When someone does this, Windows provides a few options to safeguard the key. These include:
- Saving to a Microsoft account
- Store on USB drive
- Save to a file
It is most likely that he took the first (default) option and saved it to his Microsoft account. And – gosh darn it – I cannot access his Microsoft account to obtain that key. Without the key, none of the data on his computer is accessible.
Problem number three is that my client had an AOL email account. It is not possible to log in to that account from any other computer because I don’t know the password, and neither does Jim.
AOL provides a recovery link at https://login.aol.com/forgot?.
Attempting to recover the AOL account password requires knowledge of, or access to, the following:
Alternative email account — a Yahoo email account
Text message on phone — (2**) ***-**-27
Phone call on phone — (2**) ***-** –27
Jim was unaware that his partner had an alternate email address and certainly did not know the credentials for this Yahoo account.
And this leads us to the final conundrum.
Problem number four was that Jim did not know his partner’s iPhone PIN. Apple allows up to 9 attempts (with increasing wait times of up to 8 hours) to guess the PIN before the device locks. Despite that, most iPhones lock up after four invalid attempts.
Apple will not provide the PIN to access the phone, even with appropriate documentation. They merely provide alternative access to data stored in iCloud (photos, contacts, notes, and so forth).
Sadly, this problem is multi-layered. I lack the following essential information:
- Microsoft account credentials
- AOL email account access
- iPhone access
- BitLocker recovery key
I have attempted every means and used every mechanism I know to get into this computer. All the recovery attempts I have conducted are within legal and ethical boundaries. As you can imagine, circumventing encryption or account protections without authorized credentials is neither feasible nor advisable. Notwithstanding, just last week, a security researcher posted a BitLocker exploit on GitHub, and I vainly attempted to use it – despite the potential ethical problems. I’m ashamed to say I’m not a very good hacker because I couldn’t get it to work.
While I normally laud the use of all available security mechanisms to protect a computer and personal information, in this case, my client’s failure to document or share key information exacerbated the problem. There are documents, photos, and emails that Jim wants, and I cannot retrieve them for him.
I urge you to take the necessary steps to ensure you provide your spouse, partner, offspring, caregiver, or lawyer with the essential information needed to be able to access your computer, all email accounts, cell phones, and social media accounts if you are no longer capable of doing so.
Thanks, and safe computing!