Finding EFS Encrypted Files on a volume

["Rob McComber" <rmccomber () gmail com>]

I'm wondering if anyone knows a reliable way to find EFS encrypted
files on a given volume. I'm assisting with a large-scale OS and it
looks like at least some of the users have EFS encrypted files that
they may have forgotten about. The concern I have is that after the
upgrade we won't be able to get back into the files and I'll find out
about it too late.

I have found some leads on Google, but I'm hoping someone has some
experience ferreting out EFS encrypted files across thousands of
machine.

Thoughts?

--
Rob McComber, GSEC, MCSE Security
Security Architect
rmccomber () gmail com

---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Tailor your education to your own professional goals with degree
customizations including Emergency Management, Business Continuity Planning,
Computer Emergency Response Teams, and Digital Investigations.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------