3

First, a note. This question stems from the big confusion that are terms like internal storage, internal sdcard -- at least to me -- and the fact that factory reset, which claims to "erase all data from your phone's internal storage, including [...] music, photos", doesn't touch my personal data (data in the internal sdcard, like camera media and WhatsApp conversations) at all. I don't use removable SD cards, by the way.

When I say internal sdcard, I refer to /sdcard or /data/media/0, which are equivalent in my Samsung I9300 Galaxy SIII running CM11 nightly (KitKat).

Okay, the question: will encrypting actually encrypt the entire internal storage including internal sdcard and all the rest (entire root filesystem) or will it encrypt only the data which would be affected by a factory reset (which seems to me to be only the /data/data directory)?

Improve this question
6
  • 1
    As for your confusion on storage names, you might wish to take a look at our fine storage tag-wiki (many of our tag-wikis contain useful background information and even first-aid; unfortunately, the encryption tag is still missing such a wiki). I didn't yet use any device-encryption, but AFAIR you can define what shall be encrypted. Knowing what terms refer to which storage part will certainly help you with that – see the mentioned tag-wiki :)
    – Izzy ♦
    Jun 6, 2014 at 10:30
  • Thanks, it was great! One confusion is, yesterday I found out my internal sdcard is in /data/media/0, so does it count as internal storage? (i.e it's in /data!)
    – André Chalella
    Jun 6, 2014 at 16:57
  • Speaking about that kind of confusion: not only do different manufacturers tend to mount everything in different places, that even changes with (almost) each Android version. But no, just because it's mounted into /data doesn't "convert" it to "internal storage". Check symlinks. I bet /sdcard or /mnt/sdcard are pointing there.
    – Izzy ♦
    Jun 6, 2014 at 19:22
  • Actually, I meant to say that /sdcard is a symlink to /data/media/0. Well, I guess my Android probably won't encrypt that then. If you write an answer along those lines, I'll gladly accept it!
    – André Chalella
    Jun 7, 2014 at 1:28
  • 1
    Yes, mount via adb shell confirms that both mount points come from the same device. I'm as curious as you. Guess I'll try it out and report.
    – André Chalella
    Jun 8, 2014 at 20:56

3 Answers 3

Reset to default
0

First I have to admit I'm not an expert on device encryption. I cannot speak out of first-hand experience, but at least can give some background information which definitely will prove helpful here.

So for one, there's the big confusion about storage naming. Our tag-wiki can be a big help on this. In your specific case it's the question what "internal storage" refers to, and how that differs from "internal SDCard" (which it does). So let's see how our tag-wiki defines internal storage:

Internal storage generally refers to the storage space on your device that can be used for installing applications and their associated data.

I see our tag-wiki is even more precise/detailed:

  • device storage: usually referred to as "internal storage" or "phone storage". […] On your device, this will be used for apps and data, and usually is mounted at /data
  • internal SDCard: some devices offer a separate internal SDCard, where you can store your own data (such as documents, videos, music files, pictures, etc.).

So from this you can clearly see the difference. Without , you're not able to (freely) store your personal data (as defined above) on device storage. But our apps have their own specific directories here where they can (and do) save their settings, data, and more.

Second confusion is caused by different manufacturers using different "mount points" and access-paths for storages. As you describe for your device, they might even mount the SDCard inside the /data partition. However, if the encryption setup offers you separate choices to encrypt internal storage and internal SDCard, this should not matter: If you can tell it to not encrypt a given partition, one should assume it follows this advice.

If, on the other hand, you don't get the option to not touch the internal SDCard, I'm not sure it will be left out. In that case, it might very much depend on your device (and system). When switching from UMS to MTP to provide access to your "internal SDCard" from your computer, for many of them there was a second change going along: to not "fragment" the internal storage space (i.e. "internal storage" running low while there's plenty of space available on "internal SD", or vice versa), they just use a single partition to hold both. The "internal SDCard" then is created as FUSE device, in simplified terms: pointing to a directory on internal storage. If that's true for your device, encryption of "internal storage" most likely will affect the "internal SDCard" as well. But as initially stated: I have no first-hand experience here, and thus gladly accept corrections in the comments.

Improve this answer
3
  • I suspect "internal SDCard" was a poor choice of name from the very beginning, unless there was a real card locked inside the phone in a prior era. Am I right here?
    – André Chalella
    Jun 8, 2014 at 20:58
  • Also, I don't get the part of your answer in bold. What do you mean with "it follows this advice"? The rest of the answer is just great, well done.
    – André Chalella
    Jun 8, 2014 at 21:00
  • 1
    Several "names" are not ideal choices (which can be seen by the confusion they cause). "Internal SDCard" reflects that, when it first came up, it indeed was something like a "built-in SDCard", though an "emulated one": eMMC stands for "emulated MultiMediaCard". // "If it gives that option, one should assume the option does what it suggests". What sounds natural, is not always granted :)
    – Izzy ♦
    Jun 8, 2014 at 21:06
2

Short answer: no, the emulated SDcard storage is not encrypted.

I believe I am in a similar situation as you. I have a HTC One S4 ("Ville") here which also lacks an SD card socket extension, so the phone is partitionned in a way to make it look to Android that there is an actual sdcard in there. It is mounted in /sdcard and there's a separate /data partition that holds the usual private data (contacts, sms, etc).

Following the Encrypt phone procedure from Cyanogenmod 12.1, only /data is encrypted but /sdcard is accessible without a password! That is, to say the least, a little disappointing. I am not sure it is absolutely inevitable: I suspect that the internal sdcard wasn't encrypted because it was formatted as FAT.

I was able to reformat the filesystem as EXT4 by mounting it on my laptop and re-formatting, at least. Unfortunately, vdc cryptfs enablecrypto inplace found that the phone was already encrypted and didn't attempt to encrypt the SD card. I am still at a loss as to how to encrypt that part of the phone and so have resolved to avoid storing too sensitive data on that partition.

Improve this answer
1
  • What a shame you cannot redo with ext4!
    – André Chalella
    Mar 30, 2016 at 17:09
1

Apparently, this depends on the specific device implementation.

/sdcard can get encrypted as well as can be left unencrypted while the entire devices gets encrypted with the Android's built-in "Encrypt device" function.

On some (older?) devices /sdcard and /data are two separate partitions which implies they can be wiped independently and encrypted (or not) independently. There /sdcard is most likely not enctypted when one does "Encrypt device".

By contrast, on another handset I have observed, /sdcard was a logical part of /data which implies it gets erased when doing "Factory reset" on the phone, and it very much likely gets encrypted when doing "Encrypt device".

For this particular phone, a quick experiment of filling up /data and watching available room on /sdcard shrinking synchronously (besides showing the same size in the first place) proved /sdcard and /data are the same block device, although different filesystem types.

As Android device encryption (up to Marshmallow release) uses dm-crypt, which works on the block level, I have concluded /sdcard and /data are both either encrypted or in-clear in this particular Android implementation at hand.

Improve this answer
3
  • Great answer. This is a major source of confusion in Android! Many times I was frightened by warning saying a factory reset would erase my photos and documents, only to have them untouched afterwards. IMO, encrypting a filesystem is nary worthless when it leaves personal pictures and documents in the open!
    – André Chalella
    Jun 30, 2018 at 16:57
  • I still find encrypting the /data filesystem useful, even if /sdcard goes unencrypted. Android apps have access to their private storage area which is in /data, as well as apps configuration goes in /data - and configuration files may contain passwords to external services.
    – Alexander Shcheblikin
    Jun 30, 2018 at 17:36
  • What adds to the confusion is that all files under /sdcard are accessible to all apps, while the files in /data are private to each app. So even if /sdcard is encrypted, it is still not the best place to store sensitive data.
    – Alexander Shcheblikin
    Jun 30, 2018 at 19:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .