Windows EFS protects your files using your own personal certificate. A Data Recovery Agent is an account you set up in advance with another key that will allow access to the protected files.
DRA works due to having a certificate bound to files when those files were being encrypted. Setting one up afterwards will accomplish absolutely nothing regarding any file(s) that currently exist.
Distinct from BitLocker, yet frequently confused with it.
Unlike BitLocker, which encrypts an entire volume and allows unlocking during bootup, Encrypting File System encrypts single files & folders, and it does so based on the certificate of the user who encrypted them.
Each file gets a random symmetric key, called the File Encryption Key (FEK), which is used to encrypt the file's content. The File Encryption Key is encrypted using the user's public key and stored as metadata on the file. When opening the file, the File Encryption Key is decrypted using the user's private key and then the file's content is decrypted using the File Encryption Key.
Which leads to the problem: lose access to that user’s private key — e.g., due to a deleted profile; or a rebuild on their machine; or an ex-employee; or corruption of a certificate store — and those files are unreadable even though they are sitting in plain sight in the normal file system with typical filenames.
This is configured beforehand, and out-of-sight until required.
Where a Data Recovery Agent is configured, EFS encrypts each file’s FEK a second time — with the recovery agent’s public key — and stores both of these beside one another. Either private key can therefore decrypt the file.
On a domain, the DRA is generally set up through Group Policy and assigned to a selected administrator's account, with the certificate exported and safely kept offline. However, there must be one in existence prior to encrypting files; EFS writes the recovery key into each encrypted file when it is encrypted, so assigning after they have been encrypted will accomplish nothing.
This is the reason that most organisations find the problem at the worst possible time. This method is effective and completely preventive.
Prior to determining that data has been lost.
If the original user's profile still remains on the computer, the certificate and private key should remain located in the crypto store portion of the user's profile. It is generally loss of or rebuilding/deletion of the profile that results in failure here.
Backup requests for EFS certificates appear as a Windows feature prompt to users. Surprisingly enough, those .pfx files can be found on many a USB stick & document folder.
If you are on a domain, see if there has been a recovery agent policy created & if the certificate is archived anywhere. IT personnel may have it saved somewhere without realising that's exactly what it is.
You might find older backups still containing your old user profiles and the certificate stores of those profiles; which could possibly help you recover from your current loss due to the lack of data in the systems' live certificate store(s).
Plainly said. This is one of the few "true" dead ends.
EFS-encrypted files without access to your private key or a recovery agent's cannot be decrypted. There is no way to analyse the encrypted data to find the keys.
The password used to protect the key store may sometimes be attacked with our professional password recovery service, which uses GPU acceleration and guides the process based upon what information you provide about what you remember. It works when you have a short, reused or partially remembered password; it does not when you use a strong randomly generated long password. We will let you know if you fit into either category from a free diagnostic before we ask you to pay us anything.
Where the disk that was holding the encrypted file(s) has also failed, the recovery issue is completely independent of finding a key to unlock the file(s). First we image the failed volume read only and extract all of the encrypted files intact and ready for decryption once we locate a key. Our encrypted drive services cost £800 +VAT flat after a complimentary 48-hour diagnostic.
Windows account pre-designated to unlock EFS-encrypted files it did not encrypt. Each file is also saved with an additional copy of their respective encryption key stored under the agent's certificate. Therefore, either the original user or the agent may access/decrypt the encrypted file.
Encryption in BitLocker occurs by entire volume, and the volume unlocks when the device boots. On the other hand, Encrypting File System (EFS) encrypts individual files for a specific user's digital certificate; therefore the files remain encrypted to others who may use the computer with the operating system unlocked.
No. And that is what makes this difficult. Once a file has been encrypted using EFS, there are no longer methods to assign an agent after the fact. The agent must be assigned before the encryption process begins.
The private key must be located. This could be done through looking for the original profile, if it exists, an exported .pfx backup, an archived copy of the DRA certificate in Active Directory, or old backups of the system which contain the profile. These four options should provide a solution to most of them.
This is not about the cryptography, but rather potentially finding weaknesses in the password used to protect the key store and using professional password recovery. Password recovery professionals can use their tools to find passwords which are weak, reused, or remembered poorly and/or partially. They cannot do anything with a strong randomly created password.
This problem is resolved first and separately from the rest of your issues. We image the encrypted drive as read-only so we can extract all of the encrypted files in their original form, ready to decrypt the moment a key is located. Encrypted-drive work will be charged at a flat £800 + VAT once the free diagnostic has been completed.