12
$\begingroup$

If I encrypt my SDCard on my android phone using the built-in encryption software, and my phone dies for whatever reason, would I be able to easily by just using the pin/password to access that data later on my desktops [OS X, Windows and Linux]?

Improve this question
$\endgroup$
3
  • 1
    $\begingroup$ Let me know if you think this is more of an Android question perhaps? $\endgroup$
    – McGafter
    Commented Feb 17, 2016 at 9:26
  • 1
    $\begingroup$ If you are interested in whether the encryption is possible to decrypt without the phone (as opposed to the key/similar being stored on the phone), that seems on topic. If you are interested in how to do it, that would be better asked elsewhere. $\endgroup$
    – otus
    Commented Feb 17, 2016 at 11:29
  • 1
    $\begingroup$ Disk encryption depends on android version. $\endgroup$
    – Vadym Fedyukovych
    Commented Jan 8, 2018 at 23:43

5 Answers 5

Reset to default
10
$\begingroup$

The Android developers page on Full Disk Encryption seems like it has all the info you want, and more! It talks about encryption on the main internal disk (/data), I will assume that it uses the same mechanism for encrypting the external SD Card.

In a nutshell:

When your turn Android Disk Encryption on, it generates an AES-128 key which it uses to encrypt the drive (called the master key). It then takes your Pattern / PIN / Password and uses that to derive a second AES-128 key which it uses to encrypt and store the master key on disk. You know how the first thing Android does during boot-up is ask for your PIN / Password? That's because it needs it to decrypt the master key so that it can decrypt and mount the main filesystem. The reason for having two AES-128 keys is that if you change your Pattern / PIN / Password, it just has to re-encrypt the master key file, not the whole disk.

Is it decryptable on a desktop?

Theoretically, yes.

The location of the master key file is no secret, so if you know the PIN / Password, and you know which key stretching function Android uses to turn this into an AES-128 key then you should be able to decrypt the master key, and then dercrypt the disk. Whether there is freely-available desktop software to do this, or you would have to write your own, I have no idea.

(One possible hitch is that I don't know if it stores a copy of the master key file on the external SD Card, or if there is just one copy on the internal flash memory chip. Finding a way to access the internal flash memory on the dead phone might prove to be the hard part here. You could probably check pretty easily if there's a key file on the encrypted SD Card by popping it into your laptop and looking.)

Improve this answer
$\endgroup$
2
  • $\begingroup$ "master key file" located on the same card would make it possible, otherwise it well might die with the phone. This page is for android 5 and later. $\endgroup$
    – Vadym Fedyukovych
    Commented Jan 8, 2018 at 23:47
  • 1
    $\begingroup$ It seems this answer is just false for recent Android versions, see androidcentral.com/should-you-encrypt-your-galaxy-s8s-sd-card over which I based my comment below. $\endgroup$
    – jmd
    Commented Aug 24, 2020 at 18:17
6
$\begingroup$

If it is done properly, you shouldn't be able to do that. The key itself is randomly generated at first boot / factory reset and it is stored (derived) on the device itself. PIN / password is used only to lock the key.

Improve this answer
$\endgroup$
3
$\begingroup$

I know for a fact that android stores its keys on the system storage, not the sd card. I was just factory resetting my phone a moment ago and I got a message warning me that any encrypted files on the sd card will become unreadable for precisely this reason. So what I did was I made a backup of the entire sd card through android file transfer which has permission to read the encrypted card. However, not sure if this applies to any apps that have their own encryption (banking apps, password managers etc.).

Improve this answer
$\endgroup$
2
$\begingroup$

This article https://www.androidcentral.com/should-you-encrypt-your-galaxy-s8s-sd-card implies that the implementation now uses a key that's stored only inside your phone, and that it's impossible to decrypt it elsewhere or if your phone for any reason at some point dies, or even just needs a factory reset.

So if you have data on your encrypted SD, really make sure you have regular backup elsewhere.
Right now my phone isn't dead, but it's connector is, and it's really painful to try to transfer many GB by a WiFi that seems to have decided it will be painfully slow.

Improve this answer
$\endgroup$
1
$\begingroup$

It could be that this functionality on your Android phone is implemented in the kernel as device mapper, depending on Android version.

Improve this answer
$\endgroup$
2
  • $\begingroup$ ...and if that is the case, does that mean it is easily decryptable on a desktop? $\endgroup$
    – otus
    Commented Feb 17, 2016 at 14:28
  • $\begingroup$ it was never specific enough how much easy it is expected and what is Android version or, at least, kernel options enabled. So, here's a fishing rod. $\endgroup$
    – Vadym Fedyukovych
    Commented Feb 18, 2016 at 12:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.