Up to Lollipop, native
.apk files as encrypted
.asec files (1) to
.android_secure folder in
/storage/sdcard[0|1]/. On every boot these encrypted files were decrypted and placed in a temporary filesystem mounted at
/mnt/asec/ (2) by
vold, to which the symlinks from app directories in
/data/app/ and possibly from library directories in
/data/data/ were pointing.
Starting with Marshmallow, the native method of moving apps to external SD card works only if SD card is formatted as
Adoptable Storage (3, 4):
ASEC containers have been deprecated since MNC, which is when we
introduced the "adoptable storage" feature. Adoptable storage is a
much better user experience, since we move both the APK and private
app data together as a single unit.
* MNC is Macadamia Nut Cookie; code name for Android Marshmallow (6.x).
new installs into ASEC containers are no longer supported; use adoptable storage instead.
Adoptable Storage is a Full Disk Encrypted SD card, completely managed by
vold, not visible to user as external SD card. See here how it differs from traditional Portable Storage. You can format SD card as partially Adoptable and partially Portable too.
Like the pre-Marshmallow
app2sd phenomenon (5), apps only with
installLocation set to
auto in app's
manifest are moveable:
Apps can be placed on adopted storage media only when the developer has indicated support through the
If you want to overcome this obstacle, use a third party app like
An even better approach is to move
/data/media instead of apps. Create an extra partition on external SD card and
on post-fs-data mount it to
/data/media using an
init.d script or Android's
init service. Other bigger directories
/data/data can also be moved in the same way.
If you want to keep files encrypted on external SD card, this can be achieved through native methods
FDE) for block device encryption,
ecryptfs for stacked filesystem encryption, or third party solution like
EncFS for stacked encryption. New native method of filesystem encryption
FBE) may also work, but I haven't tried.