Now, as these different versions of Android come out,
obviously, new security features are introduced.
New user features are introduced.
Now, the user features don't matter so much to us
forensically, except the things that allow
us to become lazier humans.
So think about this.
Anything that thinks on your behalf on your Android device
has to be stored somewhere.
Things that it's, like, hey, you know what, Heather,
you're spending way too much time on social media this week.
You should take a break--
like your digital being.
All of those things are tracked on the Android.
It's frightening when you look at it,
but it's amazing what we can do forensically
with this information.
So let's look at a few key concepts here.
In Android version 5, which was a Lollipop,
Full Disk Encryption, otherwise known as FDE, was introduced.
Performance issues existed, so people would opt out of it.
So Lollipop-- threatened encryption threatened to be
our biggest problem--
not really the case.
Marshmallow comes along, version 6--
full disk encryption is mandatory--
but do you see the little star--
if and only if it met specific hardware requirements.
Gatekeeper was also introduced.
What Gatekeeper does-- when you set a passcode on your Android,
if Marshmallow is the lowest version on that--
so lowest and going forward--
the password was protected by Gatekeeper.
So I want you to think about this.
Your password walks behind this gate, the gate is slammed shut,
and there's no way to open it.
It's very, very difficult.
So our old methods for brute-forcing to get access
to Marshmallow devices weren't always capable of getting
beyond the Gatekeeper.
So that became a problem.
Nougat comes along.
In comes FBE, otherwise known as File-Based Encryption.
However, full-disk encryption was also still an option.
So now you're like, wait a second.
I have an Android 7.
It could be file-based.
It could be full-disk.
How do I know?
Google the manufacturer of that device,
and see what came by default. You're
also going to see some clues as we
start looking through the data.
To add more problems, Secure Startup was introduced.
Secure Startup is your biggest nightmare
as a forensic examiner, and you're going to see why.
Then there's Secure Boot is in force.
And you look at this, and you're, like, what in the heck
did she just say?
She said FBE, FDE, two things that start with secure.
I have no idea what any of them mean.
I'm going to explain these to you, so do not panic.
And then, starting with Oreo, it strengthens.
Almost every single Android device
is going to be, if not already, file-based encrypted.
This causes us a problem.
Starting with file-based encryption,
there's no more physical access to that Android.