Is NTFS encrypted by default?
No, NTFS is not encrypted by default.
can data be read straight from the sectors in clear text?
Yes, by default NTFS files are unencrypted. Since NTFS 3.0, EFS (Encrypting File System) is a feature of NTFS, but
By default, no files are encrypted, but encryption can be enabled by users on a per-file, per-directory, or per-drive basis.
It actually doesn't need any forensics effort and is routinely done by Windows sysadmins.
- Change the password of the Windows admin by booting a toolset of choice or simply attach the disk to a Windows machine that you control
- Take ownership of the files in question (if needed)
- Profit.
OR:
Mount the NTFS partition under Linux, BSD or MacOS. No file permissions are enforced by default.
It is possible to encrypt a file, folder or an entire non-system partition in NTFS. It has to be explicitly done. Depending on how it is done it can be more or less secure.