[HTC Sensation] bastei:
Introduction

While Android allows to encrypt the /data partition this is not the case for the sdcard with many ROMs. So there are many files on the sdcard that remain accessible for wicked persons who have physical access to it. This script is an attempt to solve this problem by encrypting the content of the sdcard with the help of EncFS.

This thread is for people who have an interest to encrypt their sdcard. If you don't need it of if you want to discuss the necessity of encrypting the sdcard or encryption in general, please stay away and open a new thread if necessary.

Why EncFS?

When I was looking for a proper way to encrypt my sdcard, I wanted the following points to be fulfilled:

well-known, strong encryption method - the encrypted data should be accessible with other devices and systems (e.g. with Windows, MacOS, Linux)

conventional plain data and encrypted data on one sdcard - some file possibly should stay unencrypted (e.g. files for osmand, video files,...)

shared space for plain and encrypted data - especially with small sdcards it is more comfortable to stay with one big partition instead of splitting the sdcard

EncFS fulfills these points. Furthermore, there are working binaries and build instructions for Android thanks to Cryptionite.

Is it stable? Will it slow down my device?

I'm running my phone with encrypted sdcard for about a year now without any serious problems. I tested it with Sultanxda's CM11 KitKat ROM and ivanich's CM12 Lollipop ROM so I expect it to work at least on every CM11 and CM12 ROM. Please let me know if it works / doesn't work for you.

Using encryption will obviously slow down the read/write speed from/to sdcard. However, for me it is fast enough. As encryption and decryption is taking place in the CPU I expect the deceleration to be less on slow sdcards. But this is only an assumption.

With a SanDisk Ultra Class10 and AES 128 Bit encryption I tested the speed with the dd method on Android Lollipop:

Without encryption:

Write: 9 Mb/s

Read: 21,3 Mb/s

With EncFS encryption:

Write: 4,5 Mb/s

Read: 19,4 MB/s

Again, I hope to hear about the speed you measure.

Installation Instructions

Please backup your device before you try this! I don't know if this is working on your device and ROM. Do it at your own risk! I'm not responsible for any damage or data loss!

encrypt your /data partition. Your password for the sdcard-encryption will be stored on /data in plain text, so this is essential

install the attached zip-file via recovery

create a folder named ".encrypted" in the root of your sdcard

create an EncFS repository in the ".encrypted" folder. This is not difficult, search for howtos if you don't know what to do. You can do this on your device via adb or terminal (as root):

/system/bin/mount.encfs /sdcard/.encrypted /sdcard/decrypted

or with Linux, Windows or MacOS (via MacPorts), for example:

encfs /path-to-sdcard/.encrypted /only-temporary

save the password you entered in /data/local/passwd on your phone (adb or terminal as root)

echo "your-encfs-password-here" > /data/local/passwd

reboot

if everything works, you have the decrypted files of the ".encrypted" folder in "/storage/sdcard0" and ordinary plain files on your sdcard in "/storage/sdcard1"

now you can move the data of your apps, photos, ringtones, music,... from "/storage/sdcard1" to "/storage/sdcard0"

After flashing a new ROM, you only have to flash the zip-file again.

How does it work?

The script is executed every time you mount your sdcard (at boot and when inserting the sdcard). To achieve this, the sdcard daemon at /system/bin/sdcard is replaced with a script which performs the mounting stuff. It is looking for the ".encrypted" folder on the sdcard. If the folder exists, it decrypts it with the password stored in "/data/local/passwd". You will have the following sdcard structure dependent of the presence of the ".encrypted" folder:

".encrypted" folder is present (and "/data/local/passwd" containing the right password):

/storage/sdcard0 -> the decrypted data of .encrypted (the EncFS folder)

/storage/sdcard1 -> all the data of your sdcard

".encrypted" folder is not present:

/storage/sdcard0 -> all the data of your sdcard

So if you rename or delete the ".encrypted" folder on your sdcard, the script should react as if it doesn't exist.

There are some apps which can be configured to use another folder as "sdcard0". These can make use of "sdcard1", especially if they must access big files very fast (like Osmand or some podcast-apps).

Where is the EncFS binary from?

The EncFS binary is an ARMv7-version taken from Cryptonite. You can also build it yourself and replace the one in the zip file.