摘要： Microsoft Windows 2000 introduced the encrypting file system (EFS) , which is a component of the NTFS ifle system, and allows the user to encrypt and decrypt ifles on the NTFS partition. Given that most of the forensic softwares can not achieve forensics