The reality-- and I cannot stress this enough--
I did a webinar with Shahar Tal on Android encryption
and why it's keeping us out.
Decryption happens on the device or not at all.
The issue really came into play with file-based encryption.
All newer Android devices are file-based encryption
or file-based encrypted, depending
on how you want to word it.
It requires brute force in order to get an extraction.
This is very important.
You're also going to start seeing
some of the alphabet soup here.
So we have FDE--
as a reminder, Full-Disk Encryption--
FBE, File-Based Encryption.
If you forget what these mean, go back to Section 1
and take a look at those.
We also have AFU, and we're going to BFU.
So we have the After First Unlock or Before First Unlock.
After First Unlock means that biometric unlock is in play,
and it's a hot device.
This is a fantastic state for Android to be in.
If it's before first unlock, it's on ice.
It's cold.
And I'm going to give you a screenshot that
shows you my same device where I acquired it,
show you all the directories.
I simply rebooted that phone and then show you
all the directories.
It's drastically different on what you get.
If secure startup is enabled--
now, keep in mind, secure startup
only works on full-disk-encrypted devices
which are being aged out.
Encryption happens on the device or not at all.
So that is just a theme you want to keep in your mind.
Remember, you will come across older Android
devices that still have full-disk encryption enabled.
They still exist in the wild.
Think about how many parents hand down their old devices
to their teenagers or family members as they get new ones.
They still exist.
Chances are good you're going to see them.
Just know that file-based encryption
causes a lot of problems for us forensically.