Google Android
TMA-ANDROID-ENCRYPTION
Ensure device storage encryption is active
Description
Android 10+ devices ship with file-based encryption enabled by default; older or modified devices can be unencrypted. ro.crypto.state reports encrypted when FBE/FDE is active. The audit uses adb against the single attached device (set ANDROID_SERIAL when several are connected) and FAILS when adb is missing or no authorised device is connected. adb requires USB debugging, so disable Developer options again after the audit.
How it is checked
Audit method: Shell command
out=$(adb shell getprop ro.crypto.state 2>/dev/null) || exit 1
state=$(printf '%s' "$out" | tr -d '\r[:space:]')
if [ "$state" = encrypted ]; then echo compliant; else echo "ro.crypto.state=${state:-unset}"; fi- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Devices shipping Android 10+ are encrypted by default; if ro.crypto.state is not 'encrypted' (custom ROM, unlocked bootloader or legacy device) back up, relock the bootloader / reflash stock firmware or retire the device. Legacy devices: Settings > Security > Encrypt phone. EMM: Android Management API policy encryptionPolicy=ENABLED_WITH_PASSWORD.
Properties
- Operating systems
- Any
- Tags
- androidencryptiondata-at-rest
- Reference
- CIS Google Android Benchmark - Encryption (verify section number for your release)
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target android