Sisters EFS Miss-hap

I'll lay the background down first. Ever since my sister has had a computer she lets all her friends use it for what ever, when ever, and how ever they want. This has caused many problems. This problem is by far the worst, she takes a LOT of pictures of friends, family, and good times; one of the friends that "knows computers" enabled the Windows EFS for ALL her pictures for the last 5 years. In it self this wouldn't be a problem but i didn't find out about this till after i re-formated her computer, wiping the security certificates at the same time. Now on the the question

i know the windows passwords are VERY susceptible to rainbow table attacks, i have the tables and programs to use BUT i don't have the hash for the files. does anyone know of a way to extract the hash code from one of the encrypted files? or some other way to break the encryption?