Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

In Android's filesystem encryption do they also encrypt the SDcard? If so Is encrypting the SDcard optional or is it encrypted by default when you choose to encrypt your device?

Here's some info about Android's file system encryption and its crypto implemenation on android.com

share|improve this question
    
It is very difficult to decrypt your question ;-) –  Narayanan Jul 25 '12 at 11:05
    
I have tried rephrasing it, hopefully it will be easier to understand. :) –  h00j Jul 25 '12 at 12:05

2 Answers 2

Android provides the capability to do filesystem encryption, but it's up to the vendor who builds the firmware for your device to enable it for the SD card. I have only seen a few devices with this capability enabled for the SD card, though most seem to have it for the internal storage (/data). Typically if it's enabled, there will be a menu item in the settings referring to SD card encryption.

Here's the option for the Galaxy Tab 2 for example:

enter image description here

share|improve this answer
    
Any more background on who does actually encrypt the sdcard? PS: /data is always encrypted when you do full device encryption. That's the whole point of encrypting: It's where all your app data resides, including wifi keys and Google auth tokens. SDcard encryption has some implications, you cannot use it outside the phone any more and are prone to 'do you want to format this SD card?' questions on windows. –  ce4 Jul 25 '12 at 13:23
    
@ce4: The Galaxy Tab 2 offers this. As Michael notes, it's a separate menu item: dl.dropbox.com/u/16958605/encryptsd.png –  eldarerathis Jul 25 '12 at 13:34
    
@eldarerathis: Thanks! I integrated your info into your answer. –  ce4 Jul 25 '12 at 15:29

Summary

The encryption of the SD card is a device-specific subject, but as far as Android goes, only /data gets encrypted.


Android default behaviour:

By "default", for Android, the encryption on the device is applied to /data only. This because all installed applications that get moved to the SD card are already encrypted and only usable at that specific device "origin".

See: Apps on SD Card: The Details scroll down to the below paragraph

Security and Performance Implications

Applications on SD card are mounted via Linux’s loopback interface and encrypted via a device-specific key, so they cannot be decrypted on any other device. Note that this is security measure and does not provide copy protection;


Android recommendation to developers:

See: Designing for Security scroll down to the below paragraph

Using external storage

Files created on external storage, such as SD Cards, are globally readable and writable. Since external storage can be removed by the user and also modified by any application, applications should not store sensitive information using external storage.


Why Android, why?

Android believes that external storage is a shared thing, so, to be accessible everywhere, being encrypted wouldn't work.

See: Using the External Storage

Every Android-compatible device supports a shared "external storage" that you can use to save files. This can be a removable storage media (such as an SD card) or an internal (non-removable) storage. Files saved to the external storage are world-readable and can be modified by the user when they enable USB mass storage to transfer files on a computer.


Some vendors "act on their own"

Some vendors like Motorola however have implemented the encryption to /data and /mnt/sdcard:

  • What type of encryption does Motorola Android support?

    Provides file system level encryption for both internal device memory as well as SD card. Encryption for device memory and SD card can be enabled separately via settings UI as well as via Exchange ActiveSync policies. Device has to be protected with the password lock in order for encryption to be available.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.