There are three ways to identify which encryption type is used:
Identification by device behavior
As a user you should be able to identify what encryption scheme is used by the behavior of your device when it boots (e.g. because you restarted it).
If the classic Full Disk Encryption is active your device will boot for some time and then present a special ...
I'm quoting from the Android Manual here, but:
The source I have used is not directly relevant to Marshmallow but is relevant to Lollipop and higher.
I'll just address the OP's questions now. Technical details will follow.
The default encryption key comes from a hardware source (a chip similar to a TPM) and the default password of AOSP ...
Marshmallow has two ways to treat the external SD card :
Portable Storage : In this the entire memory of the ext.SD card is available for use, if it is not encrypted (natively) and you can mount it on your PC to read/ transfer contents
Adoptable-storage: In this the ext. SD is treated as a part of the phone and when you encrypt the phone, the ext. SD card ...
There are low(er)-level commands that can be used in a shell to encrypt your user data partition. Disclaimer/Warning: the following instructions will wipe your data, ensure that you make a backup if needed.
Following these steps, you should be able to wipe your data partition and have it encrypted afterwards (similar to a factory reset):
Boot your phone ...
For me, the original answer did not work as expected. It looked like it encrypted successfully, but the UI came back very quickly and the "Encryption" setting did not show that the devices was encrypted. I then applied the commands given in the update, but it still didn't work. I then reduced the size of the data partition and it encrypted successfully. ...
this device is encrypted with FDE full-disk-encryption. depending on how you installed Magisk the forceencrypt= flag is gone. that's what the "crypto key location" refer. edit your fstab and restore encryptable= flag that might help to use Samsung encryption in boot mode. but TWRP is most likely not able to decrypt anyway, so there is no benefit of ...
As of today (May 30, 2016), the F2FS file system doesn't support shrinking. If it does by the time someone reads this, just let me know in the comments.
The solution is then to delete and re-create the entire filesystem for /data. From this related answer on Unix & Linux Stack Exchange:
mkfs.f2fs /dev/block/mmcblk0p36 11583168
This will do the trick. ...
This doesn't address how encryption is done in Nougat but addresses your concern
Because the OS can now be started up without pin/pass, so maybe this could bring some advantages to an attacker?
The boot process is actually strengthened by strictly enforcing verified boot
As explained in Google is making it harder to root Android 7.0 Nougat,
I envision it works like this:
Storage is encrypted using synchronous random key.
When the user chooses or changes a password that is based on whatever input, be it a password comprised of letters and numbers and characters, or be it a pin code, or pattern swipe, or finger print, or any other input, an asynchronous encryption algorithm is used to encrypt ...
If your phone came with Android 5 or above, the storage is encrypted by default. You can verify this by going into Settings > Security & lock screen > Encryption & credentials. It should say Encrypt phone - encrypted and it won't allow you to turn it off.
Hovewer, the safety of the encryption depends on several factors. Most importantly, you ...
I'm not an expert in the filed, it's just an analyses of the case according to my limited knowledge.
Android supports two modes of encryption; FDE and FBE. FDE encrypts whole block device i.e. userdata partition using Linux kernel's dm-crypt framework, while FBE is based on fscrypt available since Android 7. From data recovery's aspect,...
no, rooting does not affect encryption
encryption remains safe. depending on user (who is responsible for granting root access) it is not vulnerable as long as malicious app has no root permissions
rooting does no factory reset. once rooted, the simplest straight forward backup method is (FDE)
adb pull /dev/block/dm-0
rooting system is outdated. ...
All devices that run Android 5 and beyond (out of the box) are encrypted. That's probably why you don't see a separate status for device encryption as you see for Ext.SD.
Encryption can be Full-Disk Encryption (FDE) or File-Based Encryption (FBE). The device is encrypted on first boot using default encryption and once the user sets up lock screen mechanism ,...
Having a Moto X 2013 running Cyanogenmod 12.1 I also was not able to get it encrypted. Finally, I succeeded with these steps:
Enable root in Developer Settings on the phone and open a shell (Terminal app, can also be enabled in Developer Settings)
Enter su, and confirm root access
Enter setenforce 0
Now open Settings, go to Security and select Encrypt Phone....
CM13 Jan 9, 2016 build, using Nubia Z7 Max, NX505J phone
This command (ln -s /sbin/mkfs.f2fs /system/bin/mkfs.f2fs) is no longer needed as the file lives here again. There is no need to create a symbolic link.
This command no longer needs to be in HEX and if you enter hex your PW will be hex.
cryptfs enablecrypto wipe password 666f6f -
As of CM12.1 2015-10-15 the answer by Lekensteyn no longer works.
Apparently the mkfs.f2fs which is needed to create the file system, has been moved from /system/bin/ to /sbin/
Also we have to contend with SELINUX. This means that we need to do several additional steps:
mount -oremount,rw /system
ln -s /sbin/mkfs.f2fs /...
Okay, there were actually three separate issues here.
TWRP 126.96.36.199 is broken for my Nexus 4 (5.1.0)
Regarding the following error message:
could not mount data and unable to find crypto footer
The current Team Win Recovery Project (188.8.131.52) has a regression for some encrypted Lollipop devices.
Solution: revert to TWRP 184.108.40.206, which is able to decrypt ...
As I've found in this bug report, you can watch the current open files by running this command in a second shell:
while true; do lsof | grep /data; sleep 0.2; done
This checks every 0.2s which files are still in use on /data. In my case it was chainfire's SuperSU, which had a logfile opened.
Additionally, I've found out that a 2nd SDCard partition was ...
The encrypted SD card cannot be accessed in a PC unless you are connecting via a USB cable with the parent phone.
Android Marshmallow (6.0+) have a unique feature to format SD card as internal storage (I think this carries some encryption along with the formatting process). I have tried this, and after it is formatted to internal storage, the SD card is ...
As long as your phone is turned on, no matter if it is locked, in airplane mode, etc., the data partition remains indeed decrypted and therefore, as you say, you do not really take advantage of disk encryption.
Even worse: when I say that the partition is "decrypted", concretely this means that the data encryption key is present somewhere in your phone ...
TL;DR In previous Android versions you risked missing notifications, text messages etc, in case your phone rebooted or restarted for some reason when you didn't notice. Reason being, you had to boot in with your password or PIN for the device and apps in it to communicate notifications. In Nougat, this is overcome by allowing the device to boot (without any ...
So I had the same problem with an employee to whom I had given a phone. She kept forgetting to charge the phone, so when it rebooted after charging she had to hand me the phone so I could type in the password and then switch to her secondary account. Tired of this, I read some articles about multiple users. I couldn't find the right answers (or didn't ...
Countering your supplemental conditions...
To clarify I mean booting into recovery mode, ADBing, and trying to decrypt the partition directly, without artificial timeouts that OSes do.
Stock recovery doesn't have regular ADB capability (only ADB sideload, and that only flashes signed firmware).
Even with USB Debugging enabled, you can't authorize a ...
vdc cryptfs changepw default current_password default_password
does the trick. Replace current_password with the real current password.
I believe the new password specified is irrelevant, as the DEFAULT_PASSWORD constant is used anyway. However, the current password seems to be required, atleast when using hardware-based encryption.
/boot, /system, /vendor, /vbmeta and ODM Partitions are protected by android verified boot (AVB). They are not encrypted but their integrity is verified during boot. Any modification to these partitions will halt the boot flow and brick the device. At this point without EDL mode, you won't be able to flash stock OS to unbrick it.
AVB verifies vbmeta ...
I can't believe it. Entering anything (but the password) for 30 times resets the phones.
I also stumbled upon this (later on), it looks like there is default password in AOSP based ROMS: How does Marshmallow encryption work technically?
Well, sorry for bothering. The solution was simple: Don't use the wipe function of TWRP but the Format Data button in the wipe menu.
I was able to factory reset and install a different custom rom.
BTW: Don't use TWRP for Android >= 9 (Pie). As of Version 3.3.0 TWRP lacks the vendor partition feature. Pitchblack seems to be the standard now.
Edit: I think ...
Your phone launched with Android 10.
In Android 10 Full Disk Encryption has been dropped in favor of File Based Encryption
You no longer need to "encrypt a disk" as everything is encrypted provided you have a lock screen with pin/fingerprint/etc. in Android 10