It is a pre-configured Windows user account that allows decryption of files that have been encrypted by another person within a domain. This saves organisations on a regular basis. If this has not been done previously then an attempt to do so afterwards will not work.
The reason a DRA can unlock a file is simply because its certificate was attached when the file was encrypted. No other mechanism exists, therefore creating a DRA after a file has already been encrypted will do nothing to unlock it.
The Encrypting File System (EFS) has been available as part of professional versions of Microsoft Windows for years. EFS encrypts individual files or folders on a computer system using a key associated with the user account. EFS can be used completely “invisibly”: users open their files normally. In fact, so many people have unknowingly used EFS, usually only spotting it because they saw their filenames turn green while viewing them in Windows Explorer.
However, there are some serious issues once an account goes away. For example, if a user leaves your company and his/her profile is deleted, if his/her computer is rebuilt, or if his/her password is reset by an administrator instead of him/her changing it, all the files he/she encrypted will no longer be readable by anyone else, even domain administrators. This is where a Data Recovery Agent (DRA) comes into play.
Once you configure a DRA through Group Policy, the public certificate of the DRA is bound to each and every file that was encrypted after you configured the policy. Therefore, the file now has at least two keys to unlock the file. If the original user’s account were to be removed from access, the DRA’s private key could then unlock it.
The major drawback of the new security feature is simply time. This will only affect files that were encrypted after the policy went into effect. If you set up an agent today, it won’t help your older files. Because none of those old files had the certificate applied to them when they were encrypted, there is no way to go back in time.
EFS files cannot be decrypted if both the original user’s key and the Data Recovery Agent (DRA) are lost. No one (Microsoft, our company, a data recovery service, etc.) has access to decrypt those files. Be suspicious of anyone who claims otherwise.
There are simple ways to check prior to assuming that your files are unrecoverable: check to see if the user’s profile still exists on any computer or backups. Check to see if the EFS certificate was ever exported out to a .pfx file (it may have been prompted as such during initial usage). Look for system state or profile backups from before the issue occurred. Look to see if a domain controller has an archive of the user’s information.
The imaging process for the drive containing your EFS-encrypted files can be done as simply as possible. This is due to the fact that we are able to obtain an exact copy of the failing drive and then rebuild the file structure on a new or replacement drive. It will cost you from £300 +VAT after we have completed our free 48-hour diagnostic. The user profile and certificate store recovered from that image are often the way back in, as the key material may survive even when the machine does not.
We cannot crack the encryption and we will let you know that at your initial diagnostic instead of waiting until you get an invoice.
This is an account that has been enabled via Group Policy to allow it to decrypt EFS (Encrypting File System) encrypted files that belong to all other users. When this policy is put into effect, each new file that is encrypted includes the account’s certificate to create another method of access in case the original account can’t be accessed.
No, though these terms are often confused with one another. EFS encrypts individual files/folders and is what a Data Recovery Agent (DRA) is designed to cover; BitLocker encrypts entire volumes and contains a 48-digit recovery key. A DRA is completely ineffective when trying to recover a volume that has been locked by BitLocker.
No. The certificate for the agent is added at the time of encryption. Therefore, a policy that is established today will only apply to files that are encrypted going forward and there is no back door or ability to retroactively unlock previously encrypted files.
No. This encryption is secure as long as no one has access to the user’s key(s) and there is no previously installed agent configured for decryption. Before you accept this fact please review the possibility of the exportation of a .pfx certificate, surviving user profiles, previous backups, etc., including any archived copies on a domain controller.
Yes, the drive will be “imaged” read only, and the file system restored, from £300 + VAT after a free 48-hour diagnostic. Frequently we have been able to recover the customer’s user profile and certificate store from this image. No one can break the encryption itself.