backport: enable admin to recover encrypted files