4

I'm evaluating making the move to file-based encryption on my device, but am having trouble finding satisfying answers to the following questions:

  • Apps can place data in either a Credential Encrypted (CE) or Device Encrypted (DE) storage, but does this necessarily mean all files in /data/ are encrypted? What if I run echo 1 > /data/test.txt from a shell? Is test.txt encrypted via CE?

  • I want my data to be protected with more than a four-digit PIN. Can a separate boot passphrase still be used to unlock encryption?

  • To enable FBE, /data/ needs to be wiped. Can I restore a pre-FBE TWRP backup after enabling it to fully restore my data?

  • Does TWRP still prompt for encryption password at boot as it does with full-disk encryption?

  • Can I make TWRP not prompt for encryption password so I can run automated backups via OpenRecoveryScript?

  • If I create a backup without providing my encryption password, is TWRP smart enough to restore the encrypted data as-is on restore?

  • Are there any other TWRP backup or restore caveats I should be aware of before diving in?

Improve this question
1
  • Good questions, however IMHO you should split them up a bit more, may be q1, q2 and the TWRP backup topics as a third question.
    – Robert
    Jul 12, 2018 at 13:43

1 Answer 1

Reset to default
3

Android 9 and lower

Apps can place data in either a Credential Encrypted (CE) or Device Encrypted (DE) storage, but does this necessarily mean all files in /data/ are encrypted?

What will be encrypted and which key is used depends on the encryption policy. The encryption policy specifies on a per-directory base what to encrypt. Exclusions (no encryption) seem to be possible, too.

For Android 9 and below used policy us hard-coded in the source code of Android.

There you can read that currently some exclusions are known:

  • /data/apex
  • /data/data
  • /data/lost+found
  • /data/media
  • /data/misc_ce
  • /data/misc_de
  • /data/system_ce
  • /data/system_de
  • /data/user
  • /data/user_de
  • /data/vendor_ce
  • /data/vendor_de

For some of those exclusions there is an encryption policy for a subdirectory specified. However If I understand it correctly placing a files directly into one of those directories means that no encryption will be applied.

Android 10

In Android 10, the encryption policy was hardcoded into this location:

/system/extras/libfscrypt/fscrypt_init_extensions.cpp 1

Android 11+

In Android 11 and higher, the encryption policy is no longer hardcoded into a centralized location, but rather is defined by arguments to the mkdir commands in the init scripts. Directories encrypted with the system DE key use encryption=Require, while unencrypted directories (or directories whose subdirectories are encrypted with per-user keys) use encryption=None. 1

Improve this answer
4
  • Are you sure that /data/data is excluded from encryption? This is a directory where all app settings are. /data/user is a directory where are user files, so-called "internal storage".
    – QkiZ
    Feb 25, 2021 at 10:51
  • 1
    @QkiZ There is a comment in the source code (I have corrected the link) about that some of the devices may be excluded from encryption because their subdirectories are included in the encryption. Therefore from my understanding this exclusion list is mostly applied to the directories itself, not their subdirectories.
    – Robert
    Feb 25, 2021 at 11:40
  • @Robert You mentioned " while unencrypted directories (or directories whose subdirectories are encrypted with per-user keys) use encryption=None. 1" For FBE: What is this per-user keys, do we have separate keys per user, and do these keys changes every boot ? Is each file encrypted with a different key?
    – Lavyansi
    Nov 29, 2022 at 15:37
  • @Lavyansi Individual keys for each file is standard for file based encryption systems. But AFIK the encryption is not user specific. You only have only types: one encryption type allows access before first user has logged on. The second type requires logon before you can access the files.
    – Robert
    Nov 30, 2022 at 2:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .