22

Can an NTFS volume be read by forensics without having to log into the windows user or provide any passwords? aka can data be read straight from the sectors in clear text?

Improve this question
3
  • 2
    You don't need any specialists for this. Just plug the drive into another working computer, and it'll show up as a new Drive Letter under the File Explorer.
    – SnakeDoc
    Commented Mar 2, 2020 at 17:04
  • @Mast Doesn't your average modern USB drive use exFat? That's what mine is, anyway. Certain vehicles and cameras require USB drives to be formatted as FAT32 so that's what most of my USB drives and SD cards are formatted as.
    – StalePhish
    Commented Mar 2, 2020 at 18:45
  • 2
    @StalePhish Most hardware uses FAT because of interoperability and easier implementation when it comes to MCUs for example.
    – Num Lock
    Commented Mar 3, 2020 at 10:03

2 Answers 2

Reset to default
44

No, NTFS is not encrypted by default.

can data be read straight from the sectors in clear text?

Yes, by default NTFS files are unencrypted. Since NTFS 3.0, EFS (Encrypting File System) is a feature of NTFS, but

By default, no files are encrypted, but encryption can be enabled by users on a per-file, per-directory, or per-drive basis.

Improve this answer
1
  • 24
    Note that EFS cannot encrypt system directories, as keys are per-user (stored in the user profile/encrypted with user credentials). I also don't believe it can be enabled on entire drives, at least in modern Windows versions. BitLocker is the MS-recommended method for full disk encryption.
    – Bob
    Commented Mar 1, 2020 at 14:01
13

It actually doesn't need any forensics effort and is routinely done by Windows sysadmins.

  1. Change the password of the Windows admin by booting a toolset of choice or simply attach the disk to a Windows machine that you control
  2. Take ownership of the files in question (if needed)
  3. Profit.

OR:

Mount the NTFS partition under Linux, BSD or MacOS. No file permissions are enforced by default.

It is possible to encrypt a file, folder or an entire non-system partition in NTFS. It has to be explicitly done. Depending on how it is done it can be more or less secure.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .