2 Sorted exclusions, added full path, and added the most recent exclusions from Android source code
source | link

Apps can place data in either a Credential Encrypted (CE) or Device Encrypted (DE) storage, but does this necessarily mean all files in /data/ are encrypted?

What will be encrypted and which key is used depends on the encryption policy. The encryption policy specifies on a per-directory base what to encrypt. Exclusions (no encryption) seem to be possible, too.

The currently used policy us hard-coded in the source code of Android.

There you can read that currently some exclusions are known:

  • lost+found/data/apex
  • system_ce/data/data
  • system_de/data/lost+found
  • misc_ce/data/media
  • misc_de/data/misc_ce
  • media/data/misc_de
  • data/data/system_ce
  • user/data/system_de
  • user_de/data/user
  • /data/user_de
  • /data/vendor_ce
  • /data/vendor_de

For some of those exclusions there is an encryption policy for a subdirectory specified. However If I understand it correctly placing a files directly into one of those directories means that no encryption will be applied.

Apps can place data in either a Credential Encrypted (CE) or Device Encrypted (DE) storage, but does this necessarily mean all files in /data/ are encrypted?

What will be encrypted and which key is used depends on the encryption policy. The encryption policy specifies on a per-directory base what to encrypt. Exclusions (no encryption) seem to be possible, too.

The currently used policy us hard-coded in the source code of Android.

There you can read that currently some exclusions are known:

  • lost+found
  • system_ce
  • system_de
  • misc_ce
  • misc_de
  • media
  • data
  • user
  • user_de

For some of those exclusions there is an encryption policy for a subdirectory specified. However If I understand it correctly placing a files directly into one of those directories means that no encryption will be applied.

Apps can place data in either a Credential Encrypted (CE) or Device Encrypted (DE) storage, but does this necessarily mean all files in /data/ are encrypted?

What will be encrypted and which key is used depends on the encryption policy. The encryption policy specifies on a per-directory base what to encrypt. Exclusions (no encryption) seem to be possible, too.

The currently used policy us hard-coded in the source code of Android.

There you can read that currently some exclusions are known:

  • /data/apex
  • /data/data
  • /data/lost+found
  • /data/media
  • /data/misc_ce
  • /data/misc_de
  • /data/system_ce
  • /data/system_de
  • /data/user
  • /data/user_de
  • /data/vendor_ce
  • /data/vendor_de

For some of those exclusions there is an encryption policy for a subdirectory specified. However If I understand it correctly placing a files directly into one of those directories means that no encryption will be applied.

1
source | link

Apps can place data in either a Credential Encrypted (CE) or Device Encrypted (DE) storage, but does this necessarily mean all files in /data/ are encrypted?

What will be encrypted and which key is used depends on the encryption policy. The encryption policy specifies on a per-directory base what to encrypt. Exclusions (no encryption) seem to be possible, too.

The currently used policy us hard-coded in the source code of Android.

There you can read that currently some exclusions are known:

  • lost+found
  • system_ce
  • system_de
  • misc_ce
  • misc_de
  • media
  • data
  • user
  • user_de

For some of those exclusions there is an encryption policy for a subdirectory specified. However If I understand it correctly placing a files directly into one of those directories means that no encryption will be applied.