FBE
Definition
File-Based Encryption, the per-file key scheme that replaced Full-Disk Encryption (FDE) from Android 7.0 Nougat onward. Splits files into Credential Encrypted (CE) and Device Encrypted (DE) classes.
- Full form
- File-Based Encryption
- Replaced
- Full-Disk Encryption (FDE)
- Introduced
- Android 7.0 Nougat
- Key classes
- Credential Encrypted (CE) and Device Encrypted (DE)
Common questions
Why does FBE matter for mobile forensic acquisition?+
Because CE-class files stay encrypted until the user unlocks the device with credentials while DE-class files decrypt at boot, an examiner's ability to access data depends on whether the device is in an after-first-unlock state, which changes what extraction methods and tools can actually recover.
What is the practical difference between CE and DE data for an examiner?+
DE data, such as some system and alarm-clock data, is accessible even before the user enters a PIN, right after boot, while CE data, including most user apps and messages, only becomes accessible once the device has been unlocked at least once since restart, which is why device state at seizure matters so much.
Related terms
- APK / IPA
- Android Package and iOS App Store package, the installable bundles for the two platforms. APK is a ZIP containing AndroidManifest.xml, classes.dex and...
- ART
- Android Runtime, the AOT-compiling successor to the Dalvik virtual machine since Android 5.0 Lollipop. Apps compile to OAT files on install for...
- Secure Enclave
- The dedicated security coprocessor on iPhone 5s and later, running a separate microkernel and holding the per-class encryption keys, the passcode verifier...
- TCC.db
- Transparency, Consent and Control database at /var/mobile/Library/TCC/TCC.db on iOS. Records which apps the user has granted access to camera, microphone, photos, contacts,...
- WAL
- Write-Ahead Log, the SQLite journaling mode that writes new pages to a sibling .db-wal file before checkpointing them into the main database....