0

iOS 8 includes encryption that is enabled by default, whereas in Android it is optional.

Do both operating systems decrypt everything on boot and then the PIN is used to unlock it until it is turned off? Turning off wipes the decrypted files from volatile memory. Then when the user boots their PIN decrypts them all again. Is this true?

If so, does this mean if an encrypted device is taken when it is powered on then the pin could be bypassed (with difficulty) and the files could be accessed in a decrypted format?

2
  • You don't have decrypt everything in FDE.
    – AKS
    May 31, 2015 at 14:38
  • FDE decrypts on demand. This is required for performance reasons. May 31, 2015 at 18:54

1 Answer 1

3

This is a common misconception. The purpose of full disk encryption is to protect against offline attacks, where the storage has been connected to another computer that the attacker controls.

(For a phone, this "other" computer is typically still the phone's hardware, but booted into and running a custom OS, just because this is easier to do than to physically extract the storage from the phone. Works out the same.)

When the disk is connected to the computer it is meant to be then it is the operating system's job to protect the files, FDE does nothing.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .