Here's what I've done so far and info relating to my setup
Phone: klte - G900T (T-Mobile Samsung Galaxy S5). I'm not on SafeStrap, I'm installing to system. I'm running TWRP recovery 2.8.4.0.
I first installed the CyanogenMod 12 nightly for 20150204 with Paranoid Android GApps 5.0.1RC3. All good there. I then went to "Security" and clicked "Encrypt Phone." It didn't ask me to set a password, so I assumed it'd generate a random key for LUKS and encrypt it with the default password. All good there. It rebooted into the "Encryption Wizard," and went through encrypting the phone. Cool, I thought.
It then boot-looped on start, seemingly because it didn't yet understand how to decrypt using the default password. TWRP decrypted data on startup of the recovery just fine, so that's cool. Okay, so maybe the nightly doesn't support decrypting on boot yet. Fine. I upgraded to CM 12 20150208 (today's) and tried again. Nothing.
I then did a factory reset and wiped system, reinstalling CyanogenMod from scratch. No joy either, couldn't boot. What was weird was that I still noticed that it was mounting /dev/dm-0 at /data, so my data was still encrypted. Shoot. How to get rid of encryption? I wrote a ton of zeroes to the beginning of data to wipe out the LUKS header:
Code:
dd if=/dev/zero of=/dev/block/platform/msm_sdcc.1/by-name/userdata bs=4096
I terminated this process a while in (probably should have been more exact by specifying how much to zero, but laziness). I then ran
Code:
make_ext4fs /dev/block/platform/msm_sdcc.1/by-name/userdata
Next, reboot recovery, and all is well. Install ROM, and try encrypting again, this time setting an unlock code so that it actually uses a real encryption key instead of default. It reboots, takes a really long time, and then just continues into regular boot, no encrypting taking place, it seems to bypass that. Dangit.
I then tried switching off and on again the set_encrypted_filesystem flag to recovery:
Code:
adb shell recovery --wipe_data --set_encrypted_filesystem=off
adb shell recovery --set_encrypted_filesystem on
No joy, when I try to encrypt it still just reboots regular (albeit really slowly) into regular system and doesn't encrypt. Ugh, I feel like I've lost all progress. I've made sure to clear Dalvik and regular caches on each try, so things shouldn't be persisting. I had an old backup of the stock T-Mobile ROM, so I flashed back to that, and then tried installing CM 12 again and encrypting, and no matter what I do, I can't get to that encryption screen. (my original T-Mobile backup had EFS, Modem, etc. basically everything that TWRP would let me include) [email protected]##$!!! Y U NO ENCRYPT!?
What are my next steps? How can I see what happens in that boot, ie what fails, so I can fix it and get onto my lovely life outdoors?
Shoot, logcat shows the following
Code:
E/Cryptfs ( 241): Orig filesystem overlaps crypto footer region. Cannot encrypt in place.
I'd better just zero out the entire thing to bypass this madness. Maybe that's what I screwed up?
I wrote all zeroes to the data partition to clear it out completely:
Code:
dd if=/dev/zero of=/dev/block/platform/msm_sdcc.1/by-name/userdata bs=512
Then, encrypt, and fail to encrypt. Output from logcat:
Code:
E/Cryptfs ( 242): Bad magic for real block device /dev/block/platform/msm_sdcc.1/by-name/userdata
E/Cryptfs ( 242): Error getting crypt footer and key
I'm now going to try again by doing
Code:
adb shell dd if=/dev/zero of=/dev/block/platform/msm_sdcc.1/by-name/userdata bs=512
adb shell recovery --set_encrypted_filesystem=on
We'll see what happens. This is a weird process.
I am no expert but I had trouble with encryption on my s3 with cm rom a while back.
What eventually helped was to flash official ROM and recovery using Odin, which brought the phone back to life. and then flashing whatever you need.
Hope it helps you.
I'll have to try that. I'm compiling a list of what to try next. This is a bit of a nightmare, but I'm convinced that eventually I can get back to the way it was originally.
Okay, so all this is pretty spooky stuff, but here's what actually worked.
Grab the latest stock ROM. This will take you forever trying to find it on a stupid pay-per-download website and you'll have to hack your way around or through it to get to the download (which won't complete if you have a free account because it's too big, be forewarned). After your (premium!) download completes after 3 hours, use Odin and flash. Once your phone reboots, it'll see something's wrong with /data and will fix it. I'm not sure what fixing it entails, but I have to imagine it's something like wiping the LUKS header/footer (yes, there actually is something called a LUKS footer, as I discovered through this process) and reformatting the partition. It'll reboot again, and you'll be in happy stock land.
Next, install your recovery weapon of choice using Odin (reboot bootloader, flash, reboot recovery).
Next, wipe system and install CM 12. (20150204 works for me) Boot into CyanogenMod, and go to encrypt the phone. Here's the catch: you must use a PIN that's longer than 4 characters. I found this out the hard way. I'm not sure if six characters are required, but my four-character PIN simply didn't work and was the source of so much frustration. Give a good PIN or passphrase (passphrase is obviously better) and go forward with the encryption. My device rebooted a bunch of times and seemed to get into a boot loop. However, on each boot, it'd ask for the PIN, so I knew I was getting somewhere. Unplug it from the wall, and it should boot into the ROM.
Thank goodness, I lost a lot of time on this today.
An interesting aside: it seems that now in Android you can set a different disk encryption passphrase than your screen unlock pattern. FINALLY! Android Lollipop is awesome!
Having the exact same issue with multiple devices!!!
it is always the same! if a device was encrypted on cm12 and you wipe out everything, you will run into that problem again.
So, if a device is used and you want to format it and reuse it, the encryption will always fail! That can not be the right approach!
Understand the problem.
CyanogenMod 12 as of this point doesn't support the default encryption password, which is why it fails to boot. If the encryption password gets set to the default password, like if you change your screen pattern and not specify it for encryption also, it will fail to boot. This is a bug in CyanogenMod 12.
Your recovery also has a bug. If and when you factory reset, if the device is encrypted, the recovery should overwrite the encrypted filesystem footer with zeroes and then recreate an ext4 filesystem there and configure it properly. It doesn't, which leads to this annoying problem of not being able to boot.
rfkrocktk said:
Understand the problem.
CyanogenMod 12 as of this point doesn't support the default encryption password, which is why it fails to boot. If the encryption password gets set to the default password, like if you change your screen pattern and not specify it for encryption also, it will fail to boot. This is a bug in CyanogenMod 12.
Your recovery also has a bug. If and when you factory reset, if the device is encrypted, the recovery should overwrite the encrypted filesystem footer with zeroes and then recreate an ext4 filesystem there and configure it properly. It doesn't, which leads to this annoying problem of not being able to boot.
Click to expand...
Click to collapse
Still struggling with an S4 mini, going back to stock and reflashing again works, but after encryption i have a lot of FCs and clearing cache etc. does not help @ all
So you mean, setting a pin BEFORE encryting will cause this fault?
Cheers,
saint
saintxseiya said:
Still struggling with an S4 mini, going back to stock and reflashing again works, but after encryption i have a lot of FCs and clearing cache etc. does not help @ all
So you mean, setting a pin BEFORE encryting will cause this fault?
Cheers,
saint
Click to expand...
Click to collapse
Not exactly. If you setup encryption with a password or PIN, the encryption should more or less work. If you then change your PIN or password and that change doesn't hit the disk (ie: you elect not to use your screen unlock password as your encryption pasword), the default password will be used, which will fail on boot.
rfkrocktk said:
I wrote all zeroes to the data partition to clear it out completely:
Code:
dd if=/dev/zero of=/dev/block/platform/msm_sdcc.1/by-name/userdata bs=512
Click to expand...
Click to collapse
This is gonna be hella necroposting, but I did the same thing on different device and I know what I did wrongly. You can't just blow away the entire partition because the last 16KB needs to be dedicated to the crypto footer. Without that, Android has nowhere to store the encrypted key, "magic" header, etc. it needs to process the rest of the partition. That's also why FDE that isn't hardware-backed isn't a great idea. Anyway, that's all. Time to reformat using a slightly smaller filesystem size.
LUKS AFAIK typically uses a header and not a footer on these volumes, which is why I was confused. No idea why the logic is better to store these things at the end of the disk, it makes it much more difficult to target easily.
hello,
i have an i9500 and installed cm 12.1 (20151222) with twrp 2.8.7.0. i am using 3x3 gesture lock.
when i try to encrypt device, it shows the green encryption logo. (like zipper on his belly without the title and text saying encrypting, wait while ...)
the logo appears for a sencod, then the phone restarts with no error message or abnormality. just like i restarted the phone. so nothing happens.
- i tried leaving a 16KB+ space in the end of the data partition. but that didn't work.
- same result with any older cm 12.1 nightly releases and cm 11.
- makes no difference with a fresh install without gapps.
- i tried with built in root enabled/disabled and superSU installed.
- using pin or password instead of gesture lock does not work.
- when i try with the stock rom, it stucks at the encryption logo for hours, with no title and text. so, i pull the battery out, then i am having to wipe data.
thanks in advance for any solution offer.
As far as I know, data encryption on cm roms doesn't work.
GDReaper said:
As far as I know, data encryption on cm roms doesn't work.
Click to expand...
Click to collapse
it does work on i9000 with cm11
Hello all,
I have a Galaxy S5 G900T and have a fresh install of the latest Android 6.0 (2016-02-09) nightly. It is working perfectly but I am trying to encrypt the phone and it is not working. This worked previously on Android 5.1. When I go to Settings > Security Encrypt phone, it doesn't ask for any kind of password, I press Encrypt Phone and it immediately reboots, briefly shows the green android logo as if it's going to encrypt then shows the Cyanogenmod boot animation. I have left it on this for approximately 45 minutes before I unplugged the phone and removed the battery, then powered it back on to a normal startup. I again tried the same thing after setting a lock screen with exactly the same results.
So this apparently has something to do with Supersu and systemless root (guessing) as I did a factory reset and reinstalled the OS without installing Supersu and this time encryption worked. But now I am having trouble changing the encryption password.
I have tried the "vdc cryptfs changepw password default_password newpwd" from an adb shell method but it seems to do nothing.
I can set a password via lockscreen, but I'd like to have my boot encryption password decoupled from my lockscreen password. Does anyone have this working?
Ok I figured it out. After running "vdc cryptfs changepw password default_password newpwd" you must run "vdc cryptfs verifypw newpwd". All is working now, hopefully this helps someone else out
Interesting find, I can indeed confirm this as I've been experiencing the same issue with my GS4A SGH-i537. I can encrypt fine with a fresh OS, but post root SuperSU install, it hangs at the boot screen immediately after a brief screen of the android robot.
So turns out everything isn't working as it should after all. It is not recognizing the encryption password now. I'm going to post a new topic though as this issue isn't really the same as the original here
Hello There,
I open this thread since I worked all day long on my issue and compiling all tutos and solution from differents posts on this forum and others, I ended to managed my issue with no referenced solution until now.
First I had issue with my 3 years old Notes 3 SM-N9005 hlte Android 5.0 N9005XXUGBOJ1. No root. No custom ROM. But it was encrypted :
The WiFi disabled itself immediately after enabling it. I hard reset it and it solved the issue but it occured again 2 weeks later.
Then I decided to install a custom ROM Android 6 or 7 but instead of having a long first boot, after only 1 minute I get my phone started with "encryption unsuccessful" message. I tried other ROMs but I get same message again. I tried PIT (with Odin) but same message.
At the end I tried using TWRP-3.0.2-1 instead of CWN. It showed error messages on /data partition. Then I remember the previous encryption. I formated /data in TWRP and HURAY ! it worked \o/
Thank all experts for useful posts and warm thank to TWRP developers from TeamWin
Obelix7 said:
Hello There,
I open this thread since I worked all day long on my issue and compiling all tutos and solution from differents posts on this forum and others, I ended to managed my issue with no referenced solution until now.
First I had issue with my 3 years old Notes 3 SM-N9005 hlte Android 5.0 N9005XXUGBOJ1. No root. No custom ROM. But it was encrypted :
The WiFi disabled itself immediately after enabling it. I hard reset it and it solved the issue but it occured again 2 weeks later.
Then I decided to install a custom ROM Android 6 or 7 but instead of having a long first boot, after only 1 minute I get my phone started with "encryption unsuccessful" message. I tried other ROMs but I get same message again. I tried PIT (with Odin) but same message.
At the end I tried using TWRP-3.0.2-1 instead of CWN. It showed error messages on /data partition. Then I remember the previous encryption. I formated /data in TWRP and HURAY ! it worked \o/
Thank all experts for useful posts and warm thank to TWRP developers from TeamWin
Click to expand...
Click to collapse
How do you encrypt your phone? By system system or recovery setting? I would like to try with my twrp 2.8.7.0 with my note 3 since I gound many people looking for this solution on this encrypt problem.
Hi Yumiko,
I did encryption with stock Android 5.0 : System/Security/Encryption years ago.
Hello,
last week i decided to upgrade to A11 rom (PE+). Before i ran PE+ A10 for months without problems.
I upgraded my ofox to latest 11.1 stabile. Then Format data, wipe etc.
Now whenever i installed a rom, after a short time when rebooting system my pin isnt recognized anymore from screen lock. Theres always this "wrong pin" warning. So i cannot access my phone.
Ofox cant decrypt seither, because oft wrong pin...
Since then i Tried many different Roms (A11 and A10) and even different recoverys (twrp, los, older ofox) and firmwares.
I also reverted back to my old PE+ A10...and now even there the bug appears!
I also tried deleting all files with "lock" in it under data/system...but that leads to neverending boot-time...
It is so annoying..i dont know now i can get my phone back to function properly...
Maybe anyone has a clue?