Re: recovery/forensics of NTFS encrypted folder.

I believe cracking EFS encrypted files is not going to likely here, unless  you 
were able to somehow recover the deleted user profiles from the wiped version 
of Windows from the disk, from the domain (if it was joined to a domain) or 
from a backup.  How exactly was the disk "wiped?"  

Good information on decrypting EFS files is at 
www.beginningtoseethelight.org/efsrecovery, starting with the links to the 
commercial tools that claim to be able to attempt to brute force EFS.  I'm not 
sure if you will have success or not, or how quickly.  I haven't yet heard of 
anyone that has had success with these products when the key is lost.

Microsoft reportedly has a tool that can help recover encryption keys to 
decrypt EFS files if you pay the $100 to $300 US for a tech support call to 
them, using the phone numbers at www.microsoft.com/support, and there are the 
manual procedures listed at beginningtoseethelight.org.  But I believe these 
methods generally require having the keys from the user profile that encrypted 
the files.

You could choose to pay a disk recovery firm to attempt to recover the keys 
from the wiped disk.  I understand this could cost $1000 or more with no 
guarantees of data recovery.

kind regards,
Karl Levinson
http://securityadmin.info