“Encrypt and wipe” procedure on Android Lollipop?

Question

I know a lot of people are advocating an "encrypt and wipe" procedure for selling used Android phones. But according to the AOSP website, in Android 5.x Lollipop:

Created fast encryption, which only encrypts used blocks on the data partition to avoid first boot taking a long time.

More specifically, when Lollipop encrypts a previously unencrypted device:

To enable inplace encryption, vold starts a loop to read each sector of the real block device and then write it to the crypto block device. vold checks to see if a sector is in use before reading and writing it, which makes encryption much faster on a new device that has little to no data.

In other words, Google made a disturbing choice to only encrypt whatever space is marked as "used" in storage, not any of the free space, which could very well include unencrypted information deleted prior to encryption. Unless I'm mistaken, this is a massive security risk, makes the "encrypt and wipe" procedure nothing more than a useless placebo, and makes physical destruction the only way to reasonably secure an unencrypted Android Lollipop device.

Is this assessment of the Lollipop's encryption system accurate?

Does there exist a method to force Lollipop to use full-disk encryption instead of the "fast encryption" nonsense?

Answer 1

You're making the common mistake of asking the wrong question: “is this system secure?” instead of “is this system secure in this scenario?”.

Google's choice to not encrypt unused space makes perfect sense in the typical usage scenario where a user decides to encrypt their data, and all their current and future data is encrypted. The choice not to encrypt unused space has only minimal security impact in this scenario: on a young device, it reveals how much space has been used. Eventually, as blocks are allocated and freed, all blocks will end up encrypted, making it impossible to tell which ones are currently in use and which ones are merely formerly in use.

Data that was stored on the device but is no longer accessible is not encrypted by this procedure. This is a reasonable design, since this is an encryption feature, not a wipe feature.

You can still leverage the encryption feature to make a wipe feature by first turning on encryption, then filling the partition with data — any data. For example, if you have root shell access, cat /dev/zero >/data/zero && cat /dev/zero >/cache/zero && rm /data/zero /cache/zero after turning on encryption will wipe the free space on the partitions containing /data and /cache. Refer to your favorite Android experts for how to accomplish this without root access.

Note that even pre-Lollipop, calling the procedure you describe “encrypt and wipe” is a misnomer. If there was a true wipe, encryption wouldn't be useful, the data would be gone anyway. It's really “encrypt and reset”, where the reset makes data inaccessible through normal means, but not wiped.

Answer 2

Android's in-place encryption works very well for new and existing files, but the fact it doesn't wipe free space has to be kept in mind. Note that even if it did a "full-disk" encryption as you say, where it declares the whole partition as "encrypted", doesn't help, because it wouldn't overwrite all blocks too.

Most guides I've seen include to additional steps 3. "set up encryption again, then fill with large data until limit is reached" and 4. "wipe again", to the 1. encrypt, 2. wipe. The third step will fill and overwrite the free storage of the /data partition.

Even these two steps don't overwrite everything, as some data still can remain in reserved space, what tune2fs -l reports as "Reserved block count", but this value is usually set to 0 for android devices (at least mine reports it that way), and other areas reserved for the file system. The only way to be really sure all data are deleted, is to unmount the /data partition (e.g. when the device is in recovery mode), and wipe the whole device file, then create a new ext4 file system, if its intended to be sold.

Also, note that an 1. encrypt step is unneccessary, you can directly reformat the drive, encrypt, fill and wipe.