Find out whether the device is full disk encrypted and what encryption was used?

Question

Since Android 3.0 full disk encryption is supported, but I can't see any API to that ability. The two specific things I need to know are:

1. Whether the device is encrypted?
2. What encryption is used.

I found a low level explanation of the process here and it seems to suggest the encryption used is 128 AES with CBC and ESSIV:SHA256, but it does not talk about a way to find whether the device is encrypted.

So, is there a way my app can query whether the device is using the full disk encryption feature, or do I need to resort to hacky solutions like Runtime.exec calls?

Answer 1

As @Mikle mentions you can just call the DevicePolicyManager and ask it the status

@SuppressLint("NewApi")
    private boolean isEncrypted(Context context) {
        DevicePolicyManager devicePolicyManager = (DevicePolicyManager) context
                .getSystemService(Context.DEVICE_POLICY_SERVICE);

        if (Build.VERSION.SDK_INT > Build.VERSION_CODES.HONEYCOMB) {
            int status = devicePolicyManager.getStorageEncryptionStatus();
            if (DevicePolicyManager.ENCRYPTION_STATUS_ACTIVE == status) {
                return true;
            }
        }
        return false;
    }

Answer 2

I think the API you're looking for is part of the Device Administration APIs. Specifically, you'll need to set up a DeviceAdminReceiver and, in the "uses-policies" section of device_admin.xml, add an "encrypted-storage" element. Then you'll be free to call setStorageEncryption to indicate what type of encryption to enforce. DeviceAdminSample.java should provide you with much of the code you'll need. This is kind of an indirect way of finding out whether the device is encrypted, but it's the only public API I know of.

This also won't tell you what kind of encryption is being used... I haven't been able to find an API for that.