What is Marshmallow encryption protecting?

Question

I installed CM 13.0 onto a Nexus 6, which includes Android 6.0.1, and I have set a PIN. The Settings UI reports that my phone is encrypted.

However, my phone is able to boot all the way to the lock screen without entering my PIN. This seems to imply that only /data is encrypted. I was expecting that I would have to enter a PIN at boot time, the way I did with Ice Cream Sandwich and Lollipop. Furthermore, when I go to TWRP, I can see all my files without ever entering a PIN.

My understanding was that Marshmallow required full disk encryption, and that full disk encryption would require a PIN at boot time to decrypt anything useful.

What did I misunderstand here? If someone stole my phone and didn't know my PIN, what would they have access to?

Answer 1

Because I still use Shamu as personal device, I had experience with CM ROMs.

Nexus devices with L or M had forced encryption at first bootstrap - that is, forceencrypt flag is present in fstab.qcom, so your device is automatically encrypted.

In those cases, master key is encrypted with default password, which is

default_password

Most probably, when you had set lock screen PIN, you haven't selected Require PIN to start device, hence, there is no preboot authentication.

In regard to FDE, in AOSP ROMs only /data is encrypted; but there are solutions for LUKS or PBE that are not user friendly. Several years ago, WhisperCore was launched and abandoned.

Answer 2

I do believe the password you had entered was Encrypt Device Data which in turn does what is below, not screen lock

If you have gone into settings and encrypted your device please note that IF your device had the function of Mass Storage, that feature will now be disabled as Media Storage will be the only thing you can use(media storage: add videos and or music by computer media software; no adding other folders and or files manually, ect.)

Encrypting a device and or SD card locks specifically 3rd party software and or computer interaction from getting access to the device, device files and or prying eyes let alone access to folders you once could by connecting to your computer.

To undo this that I have found useful and possibly the only way:

Format Encrypted Device

SD Formatting wipes out all user data like a clean slate and or like a new card

Device formatting wipes ALL user account information including all files like Music, Photos, Videos, ect.

It is recommend to backup these files before formatting any of the two (2)

To backup

• Settings
• Backup and reset

Make sure Backup My Data is checked

Make sure Backup Account is correct

Make sure Automatic Restore is checked

Automatic Restore: Restores user account(s), system data, downloaded system apps, restores system pictures, system videos, system music, and or anything else that was saved to the system only

IT IS RECOMMENDED TO RESTORE OVER WI-FI, IF YOU USE CARRIER DATA CHARGES MAY APPLY

Answer 3

Summary of this is: Encryption is Automatic and Ever there for Marshmallow. Especially the CM13 you are operating on. But protecting your device is your choice. The system wants to give you liberty to do what you like so it won't enforce data security even if encryption is available. When setting lock screen security, there's a question about, liking to protect your device by asking a pattern, password or PIN. This means when device switches off, and this option is on, it runs an encrypting script so as on the next bootup the phone demands the pattern to decrypt. Even TWRP will ask you for a code so as to mount /data. Note that if the whole root partition is encrypted, the device won't even use the boot.img and recovery since they rest at /dev/platform/[memory.name]/by-name/boot.img and /dev/platform/[memory.name]/by-name/recovery.img hence encryption only affects the /data partition, anyway, encryption is for protecting your data from unauthorized access not the system from accessing it's runtime essentials. Failure to agree to that prompt well count your device as decrypted and it's not encrypted on shutdown again hence it behaves like a decrypted device which is put aware to you when it tells you, "device protection features will not work on this device". That's what Android does, if you want a more practical visible type of encryption try BlackBerry 7 OS encryption and it's precedent devices. It will encrypt media, sdcards, and they won't even work on your computer through drag to copy. Unless you send then by bluetooth or any recognized upload.