I want get a complete list including all apps (including system apps) that are running in Direct Boot Mode, therefore they necessarily store their data in the DE (Device Encrypted) area (as opposed to CE = Credential Encrypted Area).
Background: As of Android 7, FBE (File-Based Encryption) was introduced as an alternative to FDE (Full-Disk Encryption). Sadly, in Android 10, FDE was removed and everyone is now forced to use FBE.
- https://source.android.com/security/encryption/file-based
- https://source.android.com/security/encryption/full-disk
There are some apps that are considered "essential" and therefore they start-up on boot. As such, information leakage can happen if the phone is booted cold by an attacker. Such apps include:
- Telephony-related apps
- Alarm apps
- Accessibility Services
- Keyboard app to enter the passphrase
- etc
For a given device, I'd like to get a complete list of all apps that are currently permitted to run in Direct Boot Mode, and I'd like to remove them (Yes, I don't want my alarm to run in Direct Boot Mode. Yes, I don't want to be able to send or recieve calls/messages in Direct Boot Mode)
How can I get a list of all of the apps that are set to start & run in Direct Boot Mode, and whose storage is then necessarily using DE instead of CE?
<application android:directBootAware="true" android:defaultToDeviceProtectedStorage="true">
apps that read AndroidManifest.xml of all installed apps should be able to show which apps have this enabled. Not sure if there is already an app to summarize apps with that setting.