Nowadays, mobile devices have been used broadly to store and process
sensitive data. To ensure confidentiality of the sensitive data, Full Disk
Encryption (FDE) is often integrated in mainstream mobile operating systems
like Android and iOS. FDE however cannot defend against coercive attacks in
which the adversary can force the device owner to disclose the decryption key.
To combat the coercive attacks, Plausibly Deniable Encryption (PDE) is
leveraged to plausibly deny the very existence of sensitive data. However, most
of the existing PDE systems for mobile devices are deployed at the block layer
and suffer from deniability compromises.
Having observed that none of existing works in the literature have
experimentally demonstrated the aforementioned compromises, our work bridges
this gap by experimentally confirming the deniability compromises of the
block-layer mobile PDE systems. We have built a mobile device testbed, which
consists of a host computing device and a flash storage device. Additionally,
we have deployed both the hidden volume PDE and the steganographic file system
at the block layer of the testbed and performed disk forensics to assess
potential compromises on the raw NAND flash. Our experimental results confirm
it is indeed possible for the adversary to compromise the block-layer PDE
systems by accessing the raw NAND flash in practice. We also discuss potential
issues when performing such attacks in real world.