It is important that some other account in addition to the encrypting user be capable of opening the file in case the user is unavailable. This duty is assigned to the data recovery agent, or DRA. In a domain, the DRA is the domain Administrator account. On a standalone server, it is the local Administrator account. On a standalone Windows 2000 Professional desktop, it is the local Admin account.
When EFS encrypts the file, it encrypts another copy of the FEK with the public key from a file recovery key pair issued by EFS to the DRA. The encrypted FEK is stored in the file in a special structure called a data recovery field, or DRF. Because the DRA's public file recovery key was used to encrypt the second copy of the FEK, the DRA's private key is required to decrypt the FEK and unlock the file.