Armory wallet files will most definitely be encrypted, you cannot actually create Armory wallet files without a password... Also note that PyWallet will not be able to help you with Armory wallet files.
As for using hexfiend... you'd be better off creating a raw image of the disk and then attempting to use file recovery software to try and locate the wallet files rather than relying on finding raw bytes.
It seems that all the Armory .wallet files that I have created start with:
BA 57 41 4C 4C 45 54 00 60 FE CD 00