Page 1
ANDROIDENCRYPTION & LOCKPROTECTIONS · A GUIDE FOR UK LAWYERS Android Encryption, Secure Boot and Lock- Screen Protections Why a Modern Android Phone Locks Like a Vault, and Why the Key Is Almost Always the Credential COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM LAWFUL CREDENTIAL-LED ACCESS CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: a vault with one key 03 How Android encryption works 04 Verified boot and the security chip 05 Lock-screen protections and the device's state 06 The credential is the key: lawful access 07 Deployment: what to do with a locked Android phone 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: a modern Android phone is encrypted by default with keys tied to the lock-screen credential and guarded by a hard w are security chip, its boot verified against tampering and its credential the phone in?"
§ 02 · FIRST PRINCIPLES The problem in plain English: a vault with one key
§ 03 · HOWANDROIDENCRYPTIONWORKS How Android encryption works SECRET
Page 2
§ 04 · VERIFIEDBOOTANDTHECHIP Verified boot and the security chip
§ 05 · LOCKPROTECTIONSANDSTATE Lock-screen protections and the device's state
§ 06 · THECREDENTIALISTHEKEY The credential is the key: lawful access
§ 07 · DEPLOYMENT Deployment: what to do with a locked Android phone
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE DEVICE MANUFACTURER LOCKED BACKUPS / (SEALED) CLOUD UNLOCKED GOOGLE PAIRED / CREDENTIAL DEVICE ACCOUNT COUNTERPART SOURCE
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THECREDENTIALTHATOPENEDTHEVAULT EXAMPLE2 · THEREBOOTTHATLOSTTHEWINDOW EXAMPLE3 · THEGUESSTHATWOULDHAVEWIPEDTHEEVIDENCE
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORALOCKEDANDROIDDEVICE
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The locked-Android checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can a laboratory just crack a locked Android phone? So what do we do with a locked phone? Why does it matter whether the phone was powered off? Can't we just try the likely PINs? How is the credential obtained law full y? If the phone stays locked, is the case stuck?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Android Encryption Secure Boot And Lock Screen Protections, Computer Forensics Lab, https://e-discovery.uk/library/android-encryption-secure-boot-and-lock-screen-protections/pdf.