A Data Recovery Agent (DRA) is something that you normally don’t even consider, until your laptop is locked and you’ve lost the recovery key. In short, it is set up in advance by the organisation and allows their IT staff to decrypt both EFS and BitLocker encrypted data on any computer covered by the organisational policies using their own DRA certificate, and not have to go searching for each individual recovery key. How does a DRA work? How does it differ from a recovery key? And what role does it play when a drive finally fails?
A DRA is basically a certificate with its own associated private key, set up via group policy prior to encrypting the drives. The public part of the certificate is applied to every drive that was encrypted under the same policy; therefore the private key can unencrypt all of them.
A Data Recovery Agent is merely an assigned certificate (a public/private key pair), defined within the organisation’s Active Directory group policy. When the DRA is established, the public certificate is automatically attached as an authorised decryptor to each subsequent drive that is encrypted under that policy in addition to each user’s protectors. The organisation’s IT staff holds the corresponding private key securely and may use it to unencrypt any of those drives. This method works equally well for BitLocker (whole-drive encryption) and EFS (individual encrypted files and folders). The DRA is the enterprise solution to a very basic question: what happens when an employee leaves, forgets a password, or someone needs access to a machine and nobody has the user’s key?
In terms of event sequence, this makes all the difference. The DRA is initially developed by IT, then distributed using group policy before any laptop is encrypted; therefore, the DRA’s public key is contained within each of their protectors upon initial deployment. It is common practice for the DRA’s private key to be kept off-line and secured either as part of a smart card or as part of a secured certificate store. Therefore, when an administrator requires access to a previously encrypted drive because the user has lost their encryption key, he/she may import the DRA’s private key into the system and utilise it to decrypt the individual laptop’s data directly. The distinction for an organisation that possesses dozens/hundreds of encrypted laptops is the difference between accessing the data on a routine basis versus having to locate a particular drive’s 48-digit recovery key.
Many people confuse the above two concepts; however, they resolve the issue from opposite directions. A BitLocker recovery key is a 48-digit code unique to a single drive: reactive, one-time, and only useful if the proper one is located. A Data Recovery Agent (DRA) represents an organisation-wide proactive resolution: one pre-configuration certificate that will provide access to any drive(s) encrypted under that policy. If you require access to only your home/personal laptop(s) and have no responsibility for other machines, then a recovery key is what you would desire. If you are responsible for a large number of machines, then establishing a DRA at the outset will prevent losing a laptop due to loss of encryption keys.
The above options both assume that the disk is working; it is just locked. In cases when the disk has failed (the disk begins to click, no longer shows up on the computer, or the encrypted volume is corrupt), then we come into play. We recover the drive from a low-level perspective by taking an image of the drive read-only and in doing so the encrypted information stays intact. Afterwards decryption will be dependent upon either the recovery key or DRA you previously had/are using as we cannot bypass BitLocker. Once we have successfully taken an image of the drive, obtaining access to the drive’s contents via your previous credentials will be easy. If there needs to be a documentation/evidentiary trail of the process, our forensic recovery service will take on the same role of recovery, but under chain of custody.
A Data Recovery Agent (DRA) is a certificate that an organisation creates for their IT department using Group Policy to enable those employees to decrypt BitLocker and EFS encrypted data across the organisation. All disks encrypted with this policy include the public DRA certificate, and the IT department holds the private DRA key which allows them to decrypt any of the disks without having to use the individual recovery keys for each disk.
No. Each recovery key is a unique 48 digit code per individual device and only used for a specific instance when needed. A Data Recovery Agent is a certificate created in advance by an organisation for all devices encrypted with a common policy that enables IT personnel to decrypt all such devices. One would use a recovery key for one personal laptop. An organisation wishing to encrypt a large number of computers/devices would create a DRA.
As for adding a Data Recovery Agent (DRA) after-the-fact, the answer is “No”; you must add the DRA when you encrypt a drive initially. That way, there is a relationship established from the beginning of the encryption process between that drive and its corresponding DRA. However, if you added a DRA down the road, all new encrypted drives would use the newly added DRA for recovery purposes. Any existing encrypted drives would still rely on their previous recovery keys. That’s why you’ll typically deploy a DRA early-on in the organisation.
To physically recover the original device from which we are recovering data, “no”. When a device fails and we’re unable to access its data through normal means, we make a read-only image of the failing encrypted disk. Then we take that exact image and recover the data contained within. Because our goal is simply to recover your failed drive, and not decrypt your data (the encryption itself cannot be bypassed), we require either your recovery key, your organisational Data Recovery Agent or your user account credentials to unlock the encrypted data.
No. Once you’ve enabled full-disk encryption via BitLocker, the data stored on that drive is very well-protected. Unless you provide us with a valid recovery key, user password or DRA for a specific encrypted volume, we, or anyone else, won’t be able to gain access to the data stored within. Although we can recover the underlying hardware components of your drive at the physical layer, once we’ve done so, decryption of that data requires a valid set of credentials. Be cautious of individuals claiming to offer services to “break” BitLocker outright.
If you have an encrypted disk which has failed, we’ll create a read-only image of the failing disk while maintaining the integrity of the contents, allowing you to unlock them using your provided recovery key or your organisation’s Data Recovery Agent. Let us know what occurred (a free diagnostic report will be created along with a fixed price quote prior to commencing any work).