Data recovery agent definition
A data recovery agent is a Windows security feature that helps organizations recover data locked away by the Encrypting File System (EFS). The data encryption agent is the user account entrusted with the organization’s EFS decryption keys.
Data recovery agents play a very important role in data security. To prevent abuse and data leaks, data recovery agent positions are typically reserved for executives or trusted IT professionals.
See also: encrypted file transfer, encryption key, key encryption key, public key encryption
How data recovery agents work
When users encrypt files or folders on their systems with EFS, they generate a File Encryption Key (FEK) — a type of cryptographic key. The FEK is encrypted with the user’s public key and stored alongside the encrypted document.
Normally, only that particular user’s private key can decrypt the FEK and the document. However, if the user who secured the file loses their private key or leaves the organization, you can be left with an encrypted block of data that nobody can access.
This is where data recovery agents come into play. The agent is issued with an encryption certificate and a corresponding private key. When a file is encrypted using EFS, a copy of its FEK is also encrypted with the agent's public key. As a result, the data recovery agent can always restore access to the encrypted files.
