6

Nougat comes with File Based Encryption (FBE) and Direct Boot.

I would like to return to Full Disk Encryption (FDE) instead (or in addition to FBE) and make sure the data partition is fully encrypted when the phone is turned off.

For security reasons, I actually want the phone to be a complete brick until I type-in the Full Disk Encryption password.

This should be possible since my Nexus 5x (upgrade from Marshmallow to Nougat) could do this.

I expect this to involve a factory reset and maybe even rooting, and I'm fine with that.

My reason is that File Based Encryption is inherently much less secure since it gives a choice to app developers what to encrypt and what not. Sooner or later people will store sensitive data unencrypted (for "user experience" reasons), because it's now possible.

I am aware of this question, but the author seemed confused whether his device is encrypted or not, and it doesn't answer how to use FDE instead of FBE.

So, how to use Full Disk Encryption instead of File Based Encryption?

Improve this question

1 Answer 1

Reset to default
1

You have a couple of options - regarding device status, ROM origin && course of action - though every1 of them is focused on changing flags in fstab.qcom.

Basically, while flag in fstab.qcom for FBE is 

fileencryption=contents_aes-256-xts[:filenames_aes-256-heh]

and defines options for content && metadata encryption, flag for FDE is

forceencrypt

or

encryptable

U don't need to root.

Because u have nasty Nexus 5X (had very bad experience with that device) u can unlock bootloader, boot custom recovery - TWRP will suffice - format (not wipe!) userdata, push modified fstab.qcom with flag encryptable (or forceencrypt), reboot to bootloader, and boot device.

Not quite sure whether re-locking bootloader after changing fstab.qcom will cause a bootloop (did couple of lobotomies on that devices, but haven't tried this particular scenario).

Either way, if u try to re-lock bootloader && that ends in bootloop, u can always flash a TOT file.

There r modified boot images for that device for same purpose, but with additional code - custom sepolicy for root.

Improve this answer
2
  • Well if full disk encryption is so called forceencrypt it should be enabled by default if he hadn't messed with anything. However on my phone forced encryption is enabled but doesn't require password in order to boot. However I can set pin/patter to be required on boot.
    – Једноруки Крстивоје
    Nov 28, 2017 at 23:52
  • He didn't messed with anything - on N builds, FBE (File based encryption) is introduced and on certain devices, enforced., such as Nexus 5X, as opposed to FDE (Full disk encryption). If no credential is asked in bootstrap, then, your device has default encryption where PW is default_password.
    – Ka1s3r S0z3
    Nov 29, 2017 at 0:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .