There is a semi-relevant thread on SO https://stackoverflow.com/questions/12640708/check-if-android-filesystem-is-encrypted that explains how a developer would determine if full-disk encryption is enabled, but is there an easy way for a user to know? I tried encrypting (I'm on 4.4.2) and it seemed to fail at some point but did not throw an error, just dropped me back to the homescreen at a certain point.
-
1That's not conclusive (as you said), you can set a PIN without encryption– warsongJan 17 '15 at 21:57
-
I have a Galaxy S6 that I attempted to encrypt, I started the process and took a shower. When I came back to check the results I could not tell if it was successful. The only difference is that there is no longer a choice to encrypt. That does not conclusively indicate that the phone is encrypted.– xjohndoe001x DoexAug 27 '16 at 7:27
Add a comment
|
On Oreo 8.0.0
Settings → Security & Location → Encryption & Credentials & it shows phone encrypted
Better method
Using adb command adb shell getprop ro.crypto.state ( works on unrooted devices also) returns encrypted or unencrypted
Output examples
- Oreo ( Unrooted, encrypted)
Vostro1510 ~ $ adb shell getprop ro.crypto.state
encrypted
- Marshmallow ( Rooted, unencrypted)
Vostro1510 ~ $ adb shell getprop ro.crypto.state
unencrypted
Source - Adb command to check if the device is encrypted
Note : Original question refers to Full Disk Encryption which has been replaced by File encryption from Nougat onwards. See this for details
Edit Instead of adb you can install Termux and type getprop ro.crypto.state to get the result - works on unrooted device also
-
1+1. Is there a way to know if the device uses full-disk encryption or file based encryption?– Firelord ♦Mar 1 '19 at 15:07
-
@Firelord Thanks. Yes, we have an answer here android.stackexchange.com/q/195713 Mar 1 '19 at 15:55
-
You call it "Better method". Unfortunately I don't know how many people have adb installed or not. I guess (but don't) know that most devices don't have adb.– guettliJan 9 '20 at 13:03
-
2@guettli guess you missed the app alternative towards the end of the answer Jan 10 '20 at 16:32
Same place where you start the encryption:
In (I am on 4.3) Settings -> Options -> Security,
the first entry will report the status and offer decrypt (if encrypted)
or encrypt (if not).
-
I could be wrong but isn't there a difference between FDE and system encryption? I think the one you mention is only system level.– warsongAug 27 '16 at 12:07
If your phone came with Android 5 or above, the storage is encrypted by default. You can verify this by going into Settings > Security & lock screen > Encryption & credentials. It should say Encrypt phone - encrypted and it won't allow you to turn it off.
Hovewer, the safety of the encryption depends on several factors. Most importantly, you should be using a strong password. PIN codes can be brute forced easily - Android allows you to try 5 different passwords every 30 seconds. That means brute forcing a 4 digit PIN takes less than 17 hours.
Another factor is whether you have the bootloader unlocked and what kind of encryption your phone uses.
File-based encryption
Android 10+, some devices with Android 7 - 9.
Android with FBE enabled encrypts the master key by a combination of the device key and your PIN/password. A device like this is NOT decryptable without your password even if one can run arbitrary code* on the device.
You can quickly verify if your phone is using FBE by restarting it. If it asks for PIN/password with a default-themed keyboard, it's using FBE.
A more reliable way is running adb shell getprop ro.crypto.type. You'll get the response file for FBE.
Full-disk encryption
Android 4.4 - 6, some devices with Android 7 - 9.
The master key is encrypted using only the device key by default. If you can run any code* on the device, your data is as good as unencrypted. To encrypt the master key with your PIN or password, you need to enable "secure startup" (Settings > Security & location > Screen lock > PIN or Password and tap Yes when it asks if you want to use Secure start-up). That makes the master key encrypted with the device key AND your PIN/password.
If you get a black screen with a prompt "To start Android, enter your PIN/password", then your phone is using the secure start-up. If it boots normally and asks for PIN/password with your customized keyboard, your phone is NOT using the secure start-up.
You can check if the device is using FDE by running adb shell getprop ro.crypto.type. You'll get the response block for FDE.
* you can run arbitrary code if the bootloader is unlocked, the device manufacturer (or possibly a very determined hacker) can likely do this even with bootloader locked
Read more about Android encryption here: https://source.android.com/security/encryption/
-
@alecxs You can verify this by launching TWRP on an Android <=9 device and being able to read the contents of the device without entering a password/PIN. If the key was encrypted, this would be impossible. What would it be encrypted with anyway? I tested this on a Mi A1 (tissot) when "secure start-up" was not enabled.– bladeDec 6 '20 at 17:14
-
Using the passphrase "default_password" is as good as having an unencrypted key, but I'll change the wording to reflect that.– bladeDec 6 '20 at 20:48
-
1some weird exception (forced by chinese government?) android.stackexchange.com/q/241934– alecxsOct 16 at 15:21
Try changeing default storage to SD Card
Settings -> Memory -> Default Location -> SD Card
if your phone is encrypted than you'll get a warning stating that internal memory is encrypted. Of course its only a hint, not a proof.
My P9 Lite (Android 7) behaves like that, and this is consistent with user guide page 193
Full-disk encryption | All data on the memory chipset is automatically encrypted
