25,000 is the minimum. The client tests the speed of your system and determines how much computation can be done in ... 0.1s? If it's 40,000 SHA512 hashes, it uses that. If it's 10,000, it uses 25,000. i.e. max(computeSysSpeed(), 25,000)

So that value must be stored in the wallet file somewhere, I just don't know where...

mcorlett... if you figure this out, I think I have all the other pieces it would take me a couple hours to put together a script that would take nDeriveIter and the passphrase, and spit out a list of pub/priv keypairs... maybe we could negotiate a splitting of the bounty for this?