0

This post here: https://android.stackexchange.com/a/218963/364009

outlines the snapshots location for the app switcher when an app is sent to the background, /data/system_ce/userid/snapshots, or at least something similar for File Based Encryption Android phones running 9.0 pie and below.

Are these snapshots also encrypted in Full Disk encryption?

For Android 9 supporting File Based Encryption and up, (Android 10, 11, etc.), are these snapshots encrypted? If not, can they be recovered after a factory reset with special software?

See post here: https://android.stackexchange.com/a/198080/364009

mentioning exceptions to directories that are not encrypted, like /system_ce, because their subdirectories are encrypted. Does this mean these snapshots are encrypted if /userid is also encrypted or /userid/snapshots is encrypted?

Thank you!

Edited for clarity of Android versions of interest and typo.

Edit 3/15: this link here:

https://github.com/corona-warn-app/cwa-app-android/issues/987

Says “When the app is sent to the background, Android takes a snapshot of the latest view of the application and saves it without encryption on the file system.” How is this possible - I would assume the snapshots would be encrypted?

6
  • Even files that are only encrypted with the device encryption key (thus they are not bound to the user secret) can not be recovered after a factory reset as al keys are erased on a factory reset.
    – Robert
    Mar 9, 2022 at 8:07
  • Correct, but with file based encryption, aren't specific files now tied to their own key? So I wanted to make sure that these task switching snapshots specifically were encrypted, is that the case? I believe they were with full disk encryption. Mar 9, 2022 at 13:28
  • Q1. FDE what do you expect remain unencrypted on full-disk encryption Q2. FBE "ce" = "credential encrypted" Q3. what is the difference
    – alecxs
    Mar 12, 2022 at 12:41
  • Does anyone know or can confirm that app snapshots are indeed encrypted? Mar 16, 2023 at 15:02
  • @AndroidUser558 Can you define what you think 'encrypted' means given that the issue ticket referenced Access to this location requires an attacker to have root privileges Mar 16, 2023 at 18:14

0

You must log in to answer this question.