0

iOS 8 includes encryption that is enabled by default, whereas in Android it is optional.

Do both operating systems decrypt everything on boot and then the PIN is used to unlock it until it is turned off? Turning off wipes the decrypted files from volatile memory. Then when the user boots their PIN decrypts them all again. Is this true?

If so, does this mean if an encrypted device is taken when it is powered on then the pin could be bypassed (with difficulty) and the files could be accessed in a decrypted format?

||improve this question
  • You don't have decrypt everything in FDE. – Ayesh K May 31 '15 at 14:38
  • FDE decrypts on demand. This is required for performance reasons. – Neil Smithline May 31 '15 at 18:54
3

This is a common misconception. The purpose of full disk encryption is to protect against offline attacks, where the storage has been connected to another computer that the attacker controls.

(For a phone, this "other" computer is typically still the phone's hardware, but booted into and running a custom OS, just because this is easier to do than to physically extract the storage from the phone. Works out the same.)

When the disk is connected to the computer it is meant to be then it is the operating system's job to protect the files, FDE does nothing.

||improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.