iOS 8 encryption vs Android Lollipop encryption

Question

iOS 8 includes encryption that is enabled by default, whereas in Android it is optional.

Do both operating systems decrypt everything on boot and then the PIN is used to unlock it until it is turned off? Turning off wipes the decrypted files from volatile memory. Then when the user boots their PIN decrypts them all again. Is this true?

If so, does this mean if an encrypted device is taken when it is powered on then the pin could be bypassed (with difficulty) and the files could be accessed in a decrypted format?

Answer 1

This is a common misconception. The purpose of full disk encryption is to protect against offline attacks, where the storage has been connected to another computer that the attacker controls.

(For a phone, this "other" computer is typically still the phone's hardware, but booted into and running a custom OS, just because this is easier to do than to physically extract the storage from the phone. Works out the same.)

When the disk is connected to the computer it is meant to be then it is the operating system's job to protect the files, FDE does nothing.