Glossary
Credential Encrypted (CE) and Device Encrypted (DE) Storage
Android splits user data into credential-encrypted storage, unlocked by the passcode, and device-encrypted storage, available at boot; CE holds most app data.
Android's file-based encryption sorts files into storage classes, each with its own keys:
- Credential encrypted (CE) storage is the default location for app data. Its keys are derived with the user's lock screen credential, so CE files can be decrypted only after the user unlocks the device once after boot. Paths include
/data/data/<package>(an alias of/data/user/0/<package>),/data/system_ce/<user>and/data/misc_ce/<user>. - Device encrypted (DE) storage is available as soon as the device boots, before any unlock, for components that must work at boot: alarms, the phone app, accessibility, some telephony data. Paths include
/data/user_de/<user>/<package>,/data/system_de/<user>,/data/misc_de/<user>, and system-wide areas such as/data/systemand/data/misc.
Apps choose DE explicitly (direct boot aware); everything else is CE. For an examiner the split decides the value of a BFU or AFU phone: in BFU a privileged extraction can still read DE files such as packages.xml, Wi-Fi and Bluetooth configuration and accounts_de.db, while messaging databases, browser history and, from Android 11, usagestats are CE. The Access field of each artifact page, for example accounts databases, states which class it lives in.