How to Inspect Storage Volumes and File-Based Encryption on Android Using ADB dumpsys vold

Modern mobile security, enterprise device protection, and filesystem administration on Android rely fundamentally on the Volume Daemon (vold). As a low-level native daemon running with root privileges, vold manages physical block devices, partitions, external storage media (SD cards, USB OTG drives), and adoptable storage volumes. Crucially, vold administers Android’s File-Based Encryption (FBE) architecture, managing the cryptographic keys that protect user data across device reboots. When auditing storage mount security, verifying Direct Boot operational states, or investigating storage volume mounting failures, the Android Debug Bridge (ADB) provides comprehensive diagnostic access via the dumpsys vold command.

Understanding Android vold and File-Based Encryption (FBE) Architecture

Unlike legacy Full-Disk Encryption (FDE) which encrypted the entire storage partition with a single uniform master key, Android utilizes File-Based Encryption (FBE). Under FBE, individual files are encrypted with unique keys managed by the kernel’s ext4/f2fs encryption subsystem and coordinated by vold:

• Device-Encrypted (DE) Storage: Encrypted using a key derived from hardware-backed keystore credentials (such as ARM TrustZone or dedicated Titan security chips). DE storage is unlocked immediately upon device boot before the user enters their PIN or password, allowing alarms, phone calls, and accessibility services to operate during “Direct Boot” mode.
• Credential-Encrypted (CE) Storage: Encrypted using a key tied cryptographically to the user’s lockscreen credential (PIN, pattern, or password). CE storage remains completely locked and inaccessible until the user successfully authenticates for the first time after a reboot.
• Volume and Mount Namespaces: vold dynamically provisions mount namespaces and isolated storage views (such as /storage/emulated/0/) for individual application sandboxes.
• Adoptable Storage: Re-encrypts removable microSD cards using static keys, merging external flash into the operating system’s internal encrypted storage pool.

Querying Volume Daemon Diagnostics via ADB

To inspect active block storage volumes, encryption keys, and disk states, connect an Android device with USB debugging enabled and execute:

adb shell dumpsys vold

The command outputs comprehensive storage daemon telemetry. A representative output appears as follows:

Volume Manager Diagnostics:
  FBE Mode: Enabled (f2fs)
  Has Adoptable Storage: false
  Unlocked Users:
    User 0: CE Unlocked, DE Unlocked
    User 10 (Work Profile): CE Locked, DE Unlocked
  Active Disks:
    disk:179,0:
      Sysfs Path: /sys/devices/platform/soc/.../mmc0
      Size: 128035676160 bytes
      Flags: internal, sd
  Active Volumes:
    vol-emulated-0:
      Type: emulated
      State: mounted
      Mount Path: /storage/emulated/0
      User: 0
    vol-private-1:
      Type: private
      State: mounted
      FS Type: f2fs
      Disk ID: disk:179,0

Key operational fields include:

• FBE Mode: Indicates whether File-Based Encryption is enabled and identifies the underlying encrypted filesystem (typically f2fs or ext4).
• Unlocked Users: Displays the cryptographic state of each user account. In the example above, User 0 (primary user) has both CE and DE unlocked, whereas User 10 (Work Profile) has DE unlocked but CE locked, confirming that work profile files remain encrypted in memory.
• Active Disks: Physical storage controllers detected by kernel uevents, annotated with sysfs paths, byte capacities, and partition flags.
• Active Volumes: Logical storage mount points, reflecting current filesystem types, mount paths, and user ownership bindings.

Inspecting Direct Boot and User Key States

During application development, verifying that an app functions properly during Direct Boot requires understanding how vold toggles encryption keys.

When a device boots into Direct Boot:

1. The kernel mounts the root and vendor filesystems.
2. vold unlocks the Device-Encrypted (DE) storage keyring using hardware secrets.
3. Apps with components flagged with android:directBootAware="true" start executing and can access DE storage.
4. Executing dumpsys vold during Direct Boot reveals:

   User 0: CE Locked, DE Unlocked

5. Once the user inputs their lock screen credential, vold derives the CE master key from synthetic passwords and unlocks the CE keyring, transitioning state to CE Unlocked.

Auditing External Media and OTG Mounts via sm (Storage Manager)

The vold daemon exposes interactive command-line control through Android’s sm (Storage Manager) utility. You can interact with vold directly to inspect and manage disk volumes:

# List all disks detected by vold
adb shell sm list-disks

# List all logical volumes and their mount states
adb shell sm list-volumes all

# Inspect volume UUIDs
adb shell sm list-volumes public

Simulating Storage Media Formatting and Adoption

To verify how an application responds when removable media is inserted or adopted as internal storage:

# Identify disk identifier (e.g., disk:179,64)
adb shell sm list-disks

# Format external SD card as adoptable internal encrypted storage
adb shell sm partition disk:179,64 private

# Review vold status to confirm encryption initialization
adb shell dumpsys vold

Tracing Storage Daemon Handshakes in Logcat

To monitor real-time block device uevents, key eviction logs, and mount operations, filter logcat for vold tags:

adb logcat -s vold:V StorageManagerService:V

When storage mounts or keys unlock, vold outputs kernel cryptographic interactions:

vold: Unlocking CE storage for user 0
vold: Successfully derived FBE key using Hardware Keymaster
vold: Mounted /data/user/0 with F2FS encryption options

By leveraging dumpsys vold alongside Android storage management commands, security auditors, systems engineers, and mobile developers can verify File-Based Encryption compliance, audit Direct Boot key states, and debug storage mounts with administrative precision.