11

In Android's filesystem encryption do they also encrypt the SDcard? If so Is encrypting the SDcard optional or is it encrypted by default when you choose to encrypt your device?

Here's some info about Android's file system encryption and its crypto implemenation on android.com

Improve this question
0

2 Answers 2

Reset to default
6

Android provides the capability to do filesystem encryption, but it's up to the vendor who builds the firmware for your device to enable it for the SD card. I have only seen a few devices with this capability enabled for the SD card, though most seem to have it for the internal storage (/data). Typically if it's enabled, there will be a menu item in the settings referring to SD card encryption.

Here's the option for the Galaxy Tab 2 for example:

enter image description here

Improve this answer
1
  • Any more background on who does actually encrypt the sdcard? PS: /data is always encrypted when you do full device encryption. That's the whole point of encrypting: It's where all your app data resides, including wifi keys and Google auth tokens. SDcard encryption has some implications, you cannot use it outside the phone any more and are prone to 'do you want to format this SD card?' questions on windows.
    – ce4
    Commented Jul 25, 2012 at 13:23
5

Summary

The encryption of the SD card is a device-specific subject, but as far as Android goes, only /data gets encrypted.

Android default behaviour:

By "default", for Android, the encryption on the device is applied to /data only. This because all installed applications that get moved to the SD card are already encrypted and only usable at that specific device "origin".

See: Apps on SD Card: The Details scroll down to the below paragraph

Security and Performance Implications

Applications on SD card are mounted via Linux’s loopback interface and encrypted via a device-specific key, so they cannot be decrypted on any other device. Note that this is security measure and does not provide copy protection;

Android recommendation to developers:

See: Designing for Security scroll down to the below paragraph

Using external storage

Files created on external storage, such as SD Cards, are globally readable and writable. Since external storage can be removed by the user and also modified by any application, applications should not store sensitive information using external storage.

Why Android, why?

Android believes that external storage is a shared thing, so, to be accessible everywhere, being encrypted wouldn't work.

See: Using the External Storage

Every Android-compatible device supports a shared "external storage" that you can use to save files. This can be a removable storage media (such as an SD card) or an internal (non-removable) storage. Files saved to the external storage are world-readable and can be modified by the user when they enable USB mass storage to transfer files on a computer.

Some vendors "act on their own"

Some vendors like Motorola however have implemented the encryption to /data and /mnt/sdcard:

  • What type of encryption does Motorola Android support?

    Provides file system level encryption for both internal device memory as well as SD card. Encryption for device memory and SD card can be enabled separately via settings UI as well as via Exchange ActiveSync policies. Device has to be protected with the password lock in order for encryption to be available.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .