OK, let's talk FDE versus FBE.
So on the left, we have full-disk encryption.
Make sure you know it is introduced
with Android 5, which is Lollipop, started
being enforced with Marshmallow, which
is version 6 as long as it met hardware requirements.
There were backdoor bypasses that were very easy to use.
So if you acquired an Android running 5 or 6 with UFED,
it would decrypted on the fly.
So you could get full physical access to that device.
File-based encryption-- introduced with Nougat.
This is where Direct Boot can help you.
So what Direct Boot does--
Direct Boot is made for impatient people like myself.
Imagine if you're turning off your phone
or if you're entering your passcode
and then you have to wait, and you're, like, pwwt,
I have to wait for all these files to decrypt?
This is ridiculous.
What Direct Boot enables you to do is say, OK, you know what?
After I enter my passcode, please show me
notifications from my Outlook.
Show me Gmail.
Show me missed calls.
Show me Facebook.
So whatever you say, show me in Direct Boot,
we can actually access that in a different way, forensically,
then we could everything that waits for the entire device
to decrypt.
When we look at the lock screen, you
are going to have to enter the credentials to get access
to everything.
What this means is, if your method of acquisition
does not require that device to be fully logged into,
you're going to see a lot of encrypted data
that's not going to make much sense, which is not ideal.
If you want full file system access,
you're going to have to brute-force
that passcode if it's locked.
That's not good.
With file-based encryption, if you have a hot device,
you want to acquire it immediately.
It's so, so important.
Now, let's look at these bottom two considerations here.
And when we looked at our lab in lab 1.1,
we already saw user DE.
User CE would be Credential Encrypted.
User DE would be Device Encrypted.
So user CE requires the user to fully unlock their device,
and all the files are decrypted, before the user
can see anything.
That is the most secure for a user.
User DE is when the user is impatient and tells
Direct Boot, you know what?
Outlook, Facebook, calls, calendar-- whatever you say
will be in Direct Boot.
So depending on your level of extraction,
user DE may always be a place that you
can get additional artifacts that
may be otherwise protected.