So, I accidentally encrypted my device when I booted a kernel that had "force encryption." Ooops. When I rebooted, it immediately started encrypting. (No prompts.)
I tried to decrpyt, but it kept asking me for a password (which I never set up) and then would say that the password was correct (no matter what I typed), but something is corrupted in my data... and that I had to factory reset.
Sure. Bite me, Google!
Steps to recover:
1. Power off
2. Boot into the bootloader
3. Boot into TWRP recovery. TWRP see's all my data fine and doesn't ask for a pw.
4. Backup the phone.
5. Use adb to pull the backup off the phone.
6. Go back into fastboot and run: fastboot format userdata.
7. Boot the phone normally (with a kernel that doesn't force encryption.)
8. (the only reason to boot here is so that android creates the proper /data directory structure.)
7. Back into TWRP...
8. adb again to push the TWRP backup back to the phone
9. Restore the backup made in step 4.
10. Reboot again. Success. Done. Everything works fine and I'm not encrypted.
So much for security, Google. Pfft...
Forgive my ignorance, I am not yet a n6 owner. What, are the disadvantages of encryption?
almahix said:
Forgive my ignorance, I am not yet a n6 owner. What, are the disadvantages of encryption?
Click to expand...
Click to collapse
Read and write speeds are slower as all data is decrypted and then encrypted as it is used.
Sent from my Nexus 7
EverDawn4 said:
Read and write speeds are slower as all data is decrypted and then encrypted as it is used.
Sent from my Nexus 7
Click to expand...
Click to collapse
Also due to the extra number crunching overhead, more battery burning.
I see how that is a negative. I'm surprised there isn't an easier way to disable encryption. I expect by tbe time I get one early next year some awesome dev will resolve that.
The point is that encryption has some negatives, but NO POSITIVES. What is the point of it when its so easily bypassed?
Sent from my Nexus 6
garyd9 said:
The point is that encryption has some negatives, but NO POSITIVES. What is the point of it when its so easily bypassed?
Click to expand...
Click to collapse
Encryption does have some positives, such as more protection of your data. How you describe and what you didnt doesnt show it as having much positives though
You claim it is worthless, because you could use root access and unlocked fastboot to push and pull data and all that, but can you really do all that so easily and get by the encryption without any root access and a locked bootloader? What about a not yet authorized ADB and you cant get into the device because it is locked and encrypted (in this scenario we are trying to break the encryption, not just go into the ROM and hit accept). I think everything is easier when you already have things unlocked and full system access.
Seems pretty secure to me. By the time you got to where you wanted to be, all data on the device was gone.
Mission: Accomplished.
The ONLY requirement to repeat my steps is either an installed custom recovery or an unlocked boot loader.
I'd agree with your argument if google allowed a non-encrypted fs if/when a boot loader was unlocked (which would be simple as /data is formatted on unlock anyway.)
Instead, google forces the encryption unless you swap boot partitions
Who's to say that the boot loader lock can't be worked around by someone determined? We haven't tried yet for the simple reason that the effort seems futile when we can so easily do it with fastboot. However, boot loader locks HAVE been worked around to boot custom recoveries on other devices such as Samsung and LG phones.
Once your in recovery, as I explained above, all the supposedly encrypted data is accessible.
Sent from my Nexus 6
garyd9 said:
The point is that encryption has some negatives, but NO POSITIVES. What is the point of it when its so easily bypassed?
Sent from my Nexus 6
Click to expand...
Click to collapse
It can be bypassed because you are using the default encryption key. If you set a pin or a password it changes the encryption key and you need to enter that in recovery to access the partition.
No positives... Lol
rbox said:
It can be bypassed because you are using the default encryption key. If you set a pin or a password it changes the encryption key and you need to enter that in recovery to access the partition.
Click to expand...
Click to collapse
How many "typical" users will set a pin or password? Those same users, if they are concerned about data security, would be manually enabling encryption already.
Google (and Apple) came up with this "great" idea to force encryption on by default (and, at least in Google's case, make it the ONLY choice without modifying the system boot partition.) They claim they did this to protect data. What protection is there if Google allows the "typical" user to use the "default encryption key" and it's so easy to get the data even if "encrypted?"
I think what I'm getting at here is that I was extremely disappointed that it was so easy for me to get at my "encrypted" data using back door methods. I suspect that MOST people won't set up any extra keys/pins, and will allow the default key. They'll see that the device is "encrypted" and feel some FALSE sense of security. In fact, those people are facing a performance penalty of some degree in order to have that FALSE security.
Here's how I think Google should have done things:
1. First and foremost, don't use software encryption. Require the encryption system to have some form of hardware acceleration.
2. Instead of 'forceencryption', the fs manager should default to encryption ON if the bootloader is locked, and default to OFF if the bootloader is unlocked. The result would be that unlocking the bootloader (which nukes the /data partition and causes it to be reformatted) would start with an un-encrypted userdata partition. (The user could still enable encryption.)
3. In conjunction with #2, if there's no encryption key provided by the user, then DON'T ENCRYPT. I honestly believe that a false security is WORSE than none at all, and apparently the "default" encryption key is all but useless.
On the other hand, I hope my first post in this thread helps some user (or dev) who accidentally encrypts their filesystem while playing with kernels. Up until then, it was believed that once the userdata became encrypted, there was no way to reverse it.
Keep in mind, we XDA users are not typical users so of course we could figure this out. Secondly anyone even remotely interested in security has a password on their phone. Lastly, a question, does encryption prevent people from plugging your phone into a PC and seeing your data?
SymbioticGenius said:
Keep in mind, we XDA users are not typical users so of course we could figure this out. Secondly anyone even remotely interested in security has a password on their phone. Lastly, a question, does encryption prevent people from plugging your phone into a PC and seeing your data?
Click to expand...
Click to collapse
A counter-question: Who (or what) is google trying to "protect" us from with forcing encryption on?
No, encryption doesn't seem to block normal MTP access. Basically, an "encrypted" device (with no password), once booted, appears the same as a non-encrypted device (just a bit slower on data access.) The portion of /data presented as the "internal sd card" is accessible via MTP regardless of if encryption is on or off. (other portions of /data aren't accessible via MTP.)
With adb functional, unix permissions will block quite a bit, and once you add root to the mix, the entire phone can be accessed. (selinux probably introduces more restrictions, but I'm not familiar with them.)
Again, that leads back to the question of just who google is trying to protect us from. If the phone is encrypted (with no password) by default, and can easily be decrypted if no password was provided, then what good is the encryption? Why suffer the overhead of encryption when it doesn't serve any effective purpose?
TWRP tries the default password. If you had changed it, TWRP wouldn't have worked at all.
That was not a fair assessment of the encryption used on Android.
I actually don't think it's a big deal especially since you didn't have a password. Encryption without a password is like a door without a lock.
Also I'm assuming that once a password is active that MTP will be disabled without said password?
Again.... The point is that android is forcing encryption on even without a password. I KNOW I have no password, but if having no password makes encryption useless, why FORCE it to be on?
Sent from my Nexus 6
I think it's better than the current, if you encrypt you must use a password 24/7 mode. I prefer it this way because it's currently how I use my phone. I have a pin when I feel it's necessary (work sometimes, phone charging on a table, bar hopping, etc.) or basically whenever someone might be able to access my phone without my noticing. Otherwise I have my pin off. This works almost exactly how I've been wanting it for years. As long as when my pin is active people can't plug my phone in and view my stuff.
I'm on stock ROM Nougat 7.1.1 B02 on my A2017G. ZTE had promised full phone encryption with 7.1.1, however, the phone doesn't ask me for my password at boot time but only after asking for the SIM's PIN at first login. In the security settings it says that the phone is encrypted, however, I'd rather have the full encryption that uses my password for encryption as well. Has anyone gotten encryption with PW to work on a A2017G on stock ROM? Or am I missing something and encryption is already working properly?
1. you can activate a password or pattern that will be asked after every boot or reboot
Indeed. But that's after the boot process which leads me to believe that the password isn't used as part of the encryption key. Other Nougat devices I use ask for the password before the main boot process takes place.
Hi,
I was changing pattern. Somehow I applied wrong pattern and then locked phone.
Now I can't unlock with fingerprint. There aren't any connect Google Account button even I am connected to internet mobile + wifi.
I didn't install TWRP and my phone is not rooted. Are there any way to unlock without losing any data? I can do anything possible (like root or install twrp) if I wont lose data.
wont a hard reset work
Without TWRP you can't do much...
chester2011 said:
wont a hard reset work
Click to expand...
Click to collapse
That will delete data.
Unfortunately, hard reset is the only way out of this. Since the data on the phone is encrypted, you require the pattern to decrypt the data in order to access it. This also includes access to the hash that is generated by your fingerprints which is why you need to enter your PIN or pattern on startup before you can unlock with your fingerprint.
Bottom line, never ever forget your backup authentication method!
Edit: I can't guarantee this will work, but it's worth a try:
Visit https://www.google.com/android/find (Find My Device)
Log in with your Google account
Click "Lock" and enter a new password.
Try that new password on your phone.
Sent from my ONEPLUS A5000 using Tapatalk
Trying to determine whether I should decrypt. Encrypted phone requires re-entering the password twice.
Encryption has nothing to do with requiring pin at start up. You can turn it off. And turning off encryption is not something you should do. Anyways to turn start up pin just remove the pin pass or pattern you have currently and then when you add again the first screen that pops up is the confirmation screen asking whether you want startup pin enabled. Select no and you are done..
The only real benefit to decrypting your device is if you use a custom recovery like TWRP--especially if it's not an official build of TWRP.
On some devices (especially those from One Plus) there are issues where TWRP either can't decrypt the data partition or stops being able to decrypt the data partition after an OTA.
On some phones you can just boot back up if that happens but on others you are locked out and need to reformat and reflash just so you can use the device again and if that can't be done which has been the case on some treble phones like the MI-A1 and the Essential PH-1 then your device is permanently bricked and is pretty much just an expensive paperweight.
Hello,
I need help: my note 7 asks me for a PIN when I start the system (Android) and also when I enter TWRP, and I want to remove these PIN requests.
In the 1st rom change (from Miui to pure Android - HavocOS), I did, in the following order:
-format data
-Wipe: system, dalvick, cache and date
When the system started for the first time, I configured the fingerprint sensor together with a 4 digit PIN and it is this PIN that I have to put in the system and the TWRP.
I tested other roms (Bootleggers, crDroid) and it happens the same. I've tried other recoverys, including OrangeFox and the same happens.
I've also tried reinstalling the rom by doing only format data (not doing Wipes) and doing the same.
I received the device with the rom: MIUI 10.3 Stable (10.3.5.0) [PFGMIXM]
The model name is: M1901F7G.
The Android version: 9 PKQ1. 180904.001
What else can I do?
Try not to setup pin after flashing rom and see bro...
I have managed to solve half of the problem: it is no longer encrypted and in TWRP it no longer asks for any PIN.
But on Android I do not accept the PIN that I set up along with the digital print, tell me that it is wrong.
Now the problem is to use PIN + fingerprint. I set up a PIN and when using that same PIN, tell me the PIN is wrong.
If you do not configure PIN, I can not use it without problems, but I lose access to the use of the print sensor
I rooted my device and installed magisk on the stock rom miui 10.3.5 for redmi note 7 will i receive ota updates?
and if not in order to flash newer miui versions of the rom do I need to flash vb meta?
P.Rabbit said:
I have managed to solve half of the problem: it is no longer encrypted and in TWRP it no longer asks for any PIN.
But on Android I do not accept the PIN that I set up along with the digital print, tell me that it is wrong.
Now the problem is to use PIN + fingerprint. I set up a PIN and when using that same PIN, tell me the PIN is wrong.
If you do not configure PIN, I can not use it without problems, but I lose access to the use of the print sensor
Click to expand...
Click to collapse
i am in the same situation man, i don't understand what is the problem and what is wrong...
In my case it was bad configuration, because I set up safe boot and this way I mistakenly assumed that this was related to encryption, but the error was only mine.
Check if you have set safe boot. With safe, always-on boot (a pin, a pattern or a password) every system boot and every time you enter TWRP.
Sorry my English.