In Android's filesystem encryption do they also encrypt the SDcard? If so Is encrypting the SDcard optional or is it encrypted by default when you choose to encrypt your device?
The encryption of the SD card is a device-specific subject, but as far as Android goes, only
/data gets encrypted.
Android default behaviour:
By "default", for Android, the encryption on the device is applied to
/data only. This because all installed applications that get moved to the SD card are already encrypted and only usable at that specific device "origin".
See: Apps on SD Card: The Details scroll down to the below paragraph
Security and Performance Implications
Applications on SD card are mounted via Linux’s loopback interface and encrypted via a device-specific key, so they cannot be decrypted on any other device. Note that this is security measure and does not provide copy protection;
Android recommendation to developers:
See: Designing for Security scroll down to the below paragraph
Using external storage
Files created on external storage, such as SD Cards, are globally readable and writable. Since external storage can be removed by the user and also modified by any application, applications should not store sensitive information using external storage.
Why Android, why?
Android believes that external storage is a shared thing, so, to be accessible everywhere, being encrypted wouldn't work.
Every Android-compatible device supports a shared "external storage" that you can use to save files. This can be a removable storage media (such as an SD card) or an internal (non-removable) storage. Files saved to the external storage are world-readable and can be modified by the user when they enable USB mass storage to transfer files on a computer.
Some vendors "act on their own"
Some vendors like Motorola however have implemented the encryption to
Provides file system level encryption for both internal device memory as well as SD card. Encryption for device memory and SD card can be enabled separately via settings UI as well as via Exchange ActiveSync policies. Device has to be protected with the password lock in order for encryption to be available.
Android provides the capability to do filesystem encryption, but it's up to the vendor who builds the firmware for your device to enable it for the SD card. I have only seen a few devices with this capability enabled for the SD card, though most seem to have it for the internal storage (
/data). Typically if it's enabled, there will be a menu item in the settings referring to SD card encryption.
Here's the option for the Galaxy Tab 2 for example: