There is a semi-relevant thread on SO https://stackoverflow.com/questions/12640708/check-if-android-filesystem-is-encrypted that explains how a developer would determine if full-disk encryption is enabled, but is there an easy way for a user to know? I tried encrypting (I'm on 4.4.2) and it seemed to fail at some point but did not throw an error, just dropped me back to the homescreen at a certain point.
-
1That's not conclusive (as you said), you can set a PIN without encryption– warsongCommented Jan 17, 2015 at 21:57
-
I have a Galaxy S6 that I attempted to encrypt, I started the process and took a shower. When I came back to check the results I could not tell if it was successful. The only difference is that there is no longer a choice to encrypt. That does not conclusively indicate that the phone is encrypted.– xjohndoe001x DoexCommented Aug 27, 2016 at 7:27
Add a comment
|
4 Answers
On Oreo 8.0.0
Settings → Security & Location → Encryption & Credentials & it shows phone encrypted
Better method
Using adb command adb shell getprop ro.crypto.state ( works on unrooted devices also) returns encrypted or unencrypted
Output examples
- Oreo ( Unrooted, encrypted)
Vostro1510 ~ $ adb shell getprop ro.crypto.state
encrypted
- Marshmallow ( Rooted, unencrypted)
Vostro1510 ~ $ adb shell getprop ro.crypto.state
unencrypted
Source - Adb command to check if the device is encrypted
Note : Original question refers to Full Disk Encryption which has been replaced by File encryption from Nougat onwards. See this for details
Edit Instead of adb you can install Termux and type getprop ro.crypto.state to get the result - works on unrooted device also
answered Jan 3, 2018 at 16:34
-
1+1. Is there a way to know if the device uses full-disk encryption or file based encryption?– Firelord ♦Commented Mar 1, 2019 at 15:07
-
1@Firelord Thanks. Yes, we have an answer here How can I find out if my device uses FBE or FDE? Commented Mar 1, 2019 at 15:55
-
You call it "Better method". Unfortunately I don't know how many people have adb installed or not. I guess (but don't) know that most devices don't have adb.– guettliCommented Jan 9, 2020 at 13:03
-
2@guettli guess you missed the app alternative towards the end of the answer Commented Jan 10, 2020 at 16:32
Same place where you start the encryption:
In (I am on 4.3) Settings -> Options -> Security,
the first entry will report the status and offer decrypt (if encrypted)
or encrypt (if not).
-
I could be wrong but isn't there a difference between FDE and system encryption? I think the one you mention is only system level.– warsongCommented Aug 27, 2016 at 12:07
If your phone came with Android 5 or above, the storage is encrypted by default. You can verify this by going into Settings > Security & lock screen > Encryption & credentials. It should say Encrypt phone - encrypted and it won't allow you to turn it off.
Hovewer, the safety of the encryption depends on several factors. Most importantly, you should be using a strong password. PIN codes can be brute forced easily - Android allows you to try 5 different passwords every 30 seconds. That means brute forcing a 4 digit PIN takes less than 17 hours.
Another factor is whether you have the bootloader unlocked and what kind of encryption your phone uses.
File-based encryption
Android 10+, some devices with Android 7 - 9.
Android with FBE enabled encrypts the master key by a combination of the device key and your PIN/password. A device like this is NOT decryptable without your password even if one can run arbitrary code* on the device.
You can quickly verify if your phone is using FBE by restarting it. If it asks for PIN/password with a default-themed keyboard, it's using FBE.
A more reliable way is running adb shell getprop ro.crypto.type. You'll get the response file for FBE.
Full-disk encryption
Android 4.4 - 6, some devices with Android 7 - 9.
The master key is encrypted using only the device key by default. If you can run any code* on the device, your data is as good as unencrypted. To encrypt the master key with your PIN or password, you need to enable "secure startup" (Settings > Security & location > Screen lock > PIN or Password and tap Yes when it asks if you want to use Secure start-up). That makes the master key encrypted with the device key AND your PIN/password.
If you get a black screen with a prompt "To start Android, enter your PIN/password", then your phone is using the secure start-up. If it boots normally and asks for PIN/password with your customized keyboard, your phone is NOT using the secure start-up.
You can check if the device is using FDE by running adb shell getprop ro.crypto.type. You'll get the response block for FDE.
* you can run arbitrary code if the bootloader is unlocked, the device manufacturer (or possibly a very determined hacker) can likely do this even with bootloader locked
Read more about Android encryption here: https://source.android.com/security/encryption/
-
@alecxs You can verify this by launching TWRP on an Android <=9 device and being able to read the contents of the device without entering a password/PIN. If the key was encrypted, this would be impossible. What would it be encrypted with anyway? I tested this on a Mi A1 (tissot) when "secure start-up" was not enabled.– bladeCommented Dec 6, 2020 at 17:14
-
Using the passphrase "default_password" is as good as having an unencrypted key, but I'll change the wording to reflect that.– bladeCommented Dec 6, 2020 at 20:48
-
1some weird exception (forced by chinese government?) Why can I view files from "Internal Storage" WITHOUT entering password either in OrangeFox recovery or via USB cable on PC?– alecxsCommented Oct 16, 2021 at 15:21
Try changeing default storage to SD Card
Settings -> Memory -> Default Location -> SD Card
if your phone is encrypted than you'll get a warning stating that internal memory is encrypted. Of course its only a hint, not a proof.
My P9 Lite (Android 7) behaves like that, and this is consistent with user guide page 193
Full-disk encryption | All data on the memory chipset is automatically encrypted
