1

Suppose we have a phone that:

  • Runs Android 10.
  • Uses file-based encryption.

Suppose one of the files is deleted, but the phone is immediately turned off so as to prevent the deleted file from being overwritten. Can the file be recovered and decrypted? What if the phone runs on Android 9?

Improve this question
3
  • 3
    Each file in FBE is encrypted by a different random crypto key that is stored encrypted by a different key into flash memory. I don't know how many data traces are left in file-system after deleting a file but even if we assume you would be able to fully recover the encrypted file data and th encrypted file key you would still need to decrypt the key which itself is derived multiple times from keys of a higher rank. And everything depends on a key stored protected in the CPU protected Trusted Execution Environment of your system. To my knowledge this should be next to impossible.
    – Robert
    Commented May 27, 2022 at 19:58
  • And to my knowledge there is no difference between FBE in Android 9 and 10.
    – Robert
    Commented May 27, 2022 at 19:58
  • 1
    There's this answer about "recovering" the key for FBE, but I don't know if it may work as described.
    – Andrew T. ♦
    Commented May 27, 2022 at 22:33

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .