What is the role of a Data Recovery Agent in Windows Encrypting File System (EFS)?

• A. It decrypts data when the primary user is unavailable
• B. It's a malware
• C. It's a hardware token
• D. It's a network service

Answer: (A)

In Windows Encrypting File System, a Data Recovery Agent is a designated, trusted account whose purpose is to recover encrypted data when the user who encrypted the file cannot access it. EFS protects each file with a file encryption key, and that key is itself encrypted with the user’s public key. The Data Recovery Agent holds a special certificate and private key that can decrypt that recovery key, allowing the file to be decrypted by an administrator. This provides a safe way to recover data in cases like lost keys, disabled accounts, or employee departures, and is usually configured through Group Policy. It’s a legitimate recovery mechanism, not malware, a hardware token, or a network service.