[tblair]

On the Kindle Fire we had a "secure enclave" bit of hardware so the files were encrypted with a key that was hard/impossible for users to get. I don't think regular android has anything like that, but they might use Widevine or something similar

[rkangel]

Most Android implementations these days use something based on the ARM SecureCore to manage keys for things like device encryption.