Nougat: How to use Full Disk Encryption instead of File Based Encryption? Nougat comes with File Based Encryption (FBE) and Direct Boot.

I would like to return to Full Disk Encryption (FDE) instead (or in addition to FBE) and make sure the data partition is fully encrypted when the phone is turned off.

For security reasons, I actually want the phone to be a complete brick until I type-in the Full Disk Encryption password.

This should be possible since my Nexus 5x (upgrade from Marshmallow to Nougat) could do this.

I expect this to involve a factory reset and maybe even rooting, and I'm fine with that.

My reason is that File Based Encryption is inherently much less secure since it gives a choice to app developers what to encrypt and what not. Sooner or later people will store sensitive data unencrypted (for "user experience" reasons), because it's now possible.

I am aware of this question, but the author seemed confused whether his device is encrypted or not, and it doesn't answer how to use FDE instead of FBE.

So, how to use Full Disk Encryption instead of File Based Encryption?
You have a couple of options - regarding device status, ROM origin &amp;&amp; course of action -  though every1 of them is focused on changing flags in fstab.qcom.

Basically, while flag in fstab.qcom for FBE is 

fileencryption=contents_aes-256-xts[:filenames_aes-256-heh]

and defines options for content &amp;&amp; metadata encryption, flag for FDE is

forceencrypt

or

encryptable

U don't need to root.

Because u have nasty Nexus 5X (had very bad experience with that device) u can unlock bootloader, boot custom recovery - TWRP will suffice - format (not wipe!) userdata, push modified fstab.qcom with flag encryptable (or forceencrypt), reboot to bootloader, and boot device.

Not quite sure whether re-locking bootloader after changing fstab.qcom will cause a bootloop (did couple of lobotomies on that devices, but haven't tried this particular scenario).

Either way, if u try to re-lock bootloader &amp;&amp; that ends in bootloop, u can always flash a TOT file.

There r modified boot images for that device for same purpose, but with additional code - custom sepolicy for root.