Windows Mobile 6.5 Memory Card Encryption Explained

Windows Mobile 6.5 implemented memory card encryption through a transparent, device-bound key architecture designed to protect sensitive data on removable storage. Managed via built-in system security policies or enforced remotely through Microsoft Exchange ActiveSync, this feature relied on the Windows CE Cryptographic Service Provider (CSP) to generate and manage encryption keys. By combining unique per-file symmetric keys with a master key tied directly to the device's internal protected storage, Windows Mobile 6.5 ensured that encrypted cards could not be read if removed and inserted into a PC or another mobile device.

The Storage Card Filter Driver

The implementation did not encrypt the entire physical disk partition or raw blocks; instead, it operated at the file-system level. Windows Mobile 6.5 utilized an encryption filter driver that sat between the file system (typically FAT or FAT32) and the storage device driver.

When an application requested to write a file to a removable storage card, the filter driver intercepted the input/output (I/O) request. It encrypted the file payload on the fly using symmetric encryption algorithms—most commonly AES (Advanced Encryption Standard) with a 128-bit key, or Triple-DES, provided by the Microsoft Enhanced Cryptographic Provider. When reading data, the filter driver intercepted the stream, decrypted it using the corresponding key in memory, and delivered the plaintext to the authorized application.

Key Hierarchy and Generation

Windows Mobile 6.5 utilized a two-tiered key hierarchy:

  1. File Encryption Keys (FEK): Each file written to the memory card was encrypted with its own unique, randomly generated symmetric key.
  2. Device Master Key: The FEK was not stored in plain text. Instead, it was encrypted using a master key and appended to the encrypted file's metadata header.

The master key was generated by the operating system’s cryptographic subsystem using an internal pseudo-random number generator (PRNG) seeded by device-specific hardware entropy.

Key Storage and Device Binding

Security in Windows Mobile 6.5 relied on tying the master key exclusively to the physical host device:

  • Protected System Storage: The master key was stored within the device's internal, non-volatile flash memory inside a protected registry hive or within the Windows CE Protected Store (DPAPI-like architecture). It was never written to the removable memory card itself.
  • Hardware Isolation: Because the decryption keys resided only on the internal storage of the originating handheld, moving the card to a desktop PC or another Windows Mobile phone rendered the files unreadable. The external system would see only the encrypted file wrappers with unreadable data payloads.

Lifecycle and Key Management

The encryption keys were tied directly to the operational lifecycle of the device's OS installation. Because the operating system did not provide an integrated, end-user export mechanism for private encryption keys, performing a hard reset (factory reset) on the Windows Mobile device permanently wiped the master key from the internal flash memory. Consequently, any previously encrypted storage card became permanently unrecoverable, even if reinserted into the exact same physical hardware after the reset.