Spyware causing backup failure? createTarFork() process ended with ERROR: 255 - OnePlus 5 Questions & Answers

I cannot complete a full backup. It gets to 98% and fails with the following error
I:addFile '/data/system_ce/0/recent_images/18314_activity_icon_1528351915071.png' including root: 1 ==> set selinux context: ubject_r:system_data_file:s0 I:addFile '/data/system_ce/999' including root: 1 ==> set selinux context: ubject_r:system_data_file:s0 failed to lookup tar policy for '/data/system_ce/999' - 'a502596862cdda88' I:Error adding file '/data/system_ce/999' to '/data/media/0/TWRP/BACKUPS/89b79b75/2018-06-07--01-14-13/data.ext4.win008' Error creating backup. I:ERROR tarList for thread ID 0 Error creating backup. I:InfoManager saving '/data/media/0/TWRP/BACKUPS/89b79b75/2018-06-07--01-14-13/data.info' createTarFork() process ended with ERROR: 255 Backup Failed. Cleaning Backup Folder. I:Copying file /tmp/recovery.log to /data/media/0/TWRP/BACKUPS/89b79b75/2018-06-07--01-14-13/recovery.log

Inside that folder there are screenshots of everything I'm doing on the phone! Lots of sensitive information like my PayPal or email. Is this part of the operating system or some type of Spyware?!
I'm finding many mentions of these folders on various forums and threads but the only hint is that it's related to parallel apps and the user has to be deleted. That still doesn't explain to me why it's taking screenshots of my activities
https://forum.xda-developers.com/showpost.php?p=75342215&postcount=180

I was able to finish the backup by booting back to the os and running the following from a terminal
su
pm remove-user 999
I'd still like to know why the system is screenshotting all of my apps

braschlosan said:
I was able to finish the backup by booting back to the os and running the following from a terminal
su
pm remove-user 999
I'd still like to know why the system is screenshotting all of my apps
Click to expand...
Click to collapse
Probably your phone is hijacked or as you suspect Spyware/other apps.
I would to format your internal storage and every other partition. After a clean installation of your OS check your network usage with glasswire for example to see if something is using your traffic.

braschlosan said:
Inside that folder there are screenshots of everything I'm doing on the phone! Lots of sensitive information like my PayPal or email. Is this part of the operating system or some type of Spyware?!
I'm finding many mentions of these folders on various forums and threads but the only hint is that it's related to parallel apps and the user has to be deleted. That still doesn't explain to me why it's taking screenshots of my activities
https://forum.xda-developers.com/showpost.php?p=75342215&postcount=180
Click to expand...
Click to collapse
Seems like it's AOSP recents feature; https://forum.xda-developers.com/showpost.php?p=70361290&postcount=7641

Related

[Script] VERY simple application backup script for ROM upgrades [not for newbies]

Hi,
I'm new to the business and I spent some time to learn the environment trying different applications and different approaches for almos every action I took. Today, I have not much bigger knowledge, but I finally decided to take few things in my own hands because existing software is not fulfilling my wishes.
I started with this simple script which eases the pain of reinstalling all applications after ROM upgrade. There are few such tools already, but I found those quite bloated with unnecessary thing for my own approach.
With this script I assume:
1. There is/was SSHDroid installed (or any tool with busybox and you can access shell command line) both in old and new ROMs and your ROM have bash installed in /system/bin/.
2. Backup/restore operation includes only INTERNALLY installed applications, it completely ignores SYSTEM and SDCARD installed ones.
3. This is TEMPORARY backup so it should be as fast as possible not caring about occupied space (!). Althought I added -zip parameter to enable compression if you are running out of space on your sd.
4. Installed ROM is clean with no additional apps installed (excluding those needed by the script)
5. You have basic knowledge about bash scripting, because I take NO RESPONSIBILITY of the script behavior or data loss it can do.
So, basically it is simple. It runs like this:
1. On old ROM type: sbackup -backup
2. Flash your ROM
3. On new rom type: sbackup -restore
Just like that. The applications data is tar'ed in one file per application so if you want to get rid of any, just delete it from backup directory. The directory name is same as script name on sdcard but you can change it adding a parameter without a '-' sign at runtime (first non-option parameter is treated as backup directory path). The file is zipped because this forum disallows files without an extension so... it is zipped ;D
It was tested on my fresh LeeDroid 3.3.3 GB AFTER i installed some apps. I backed them up and then restored. All seems to be perfect right now, but I will test it more thoroghly very soon because I'm planninig to have CM7 based ROM too just to choose that I need Sense or not (two nandroids for fast switch weekly ;P).
With this script and MyBackup functionality of backing up contacts, sms, history and similar it should be quite complete approach to restore all the data needed on the fresh ROM. In the future maybe I will look at the MyBackup part too. Maybe.
Feel free to comment, use, suggest or anything you like, and have fun ;P.
How do I run this script? Do i run it from sdcard or from system /bin? When i do it from system bin it says cannot create directory. When i run it from sdcard/sbackup it says permissions denied?
Sent from my ADR6400L using Tapatalk
jgrimberg1979 said:
How do I run this script? Do i run it from sdcard or from system /bin? When i do it from system bin it says cannot create directory. When i run it from sdcard/sbackup it says permissions denied?
Sent from my ADR6400L using Tapatalk
Click to expand...
Click to collapse
And thats why I mentioned in topic about not being a newbie (and I meant not forum newbie but more a linux newbie). The thing is, it's a simple script - without any user-proof capabilities, comments inside or something BUT...
But ok, I will try to help you run it. First of all, you have to set permissions to the script. It has to have executable permission to be run by the system (and I mean filesystem permission). This can be done by chmod instruction of busybox. Most of the times it's done like this:
chmod 755 filename
This is a reason of not running form sdcard if your sdcard is NOT ext filesystem (it is usually windows fat filesystem not to generate problems with reading it under windows).
Second thing to run is to have /system/bin/bash because first line of the script (a comment like this: #!/system/bin/bash) instructs busybox to execute script using bash. This can be simply changed by modifying this line, but you have to remember that changing the shell executing script have consequences. Differens shells have sometimes different syntax, althoght i wrote this script simply so it should run on most of them, especially sh.
Third thing is to have write permissions to the directory in which the backup will be created. In original version of the script it is /sdcard, because backup is made in /sdcard/sbackup. So, you have to check it (second error - problems with creating directory).
And a last tip - it can be run from ANYWHERE. Even if your partition does not alolow executing, you can do it like this:
bash-3.2# /sdcard/test
bash: /sdcard/test: /system/bin/bash: bad interpreter: Permission denied
bash-3.2# . /sdcard/test
OK
bash-3.2#
First try does not succeded, but second did. The trick is a dot which means to execute file with a shell not caring about why or permissions.
And thats most simple introduction I could write. It applies to ANY script you want to run.
Please anyone - if you want me to help, paste your results here because without a precise error message it can be very hard to deduce what caused for example permission denial or anything usual.
For now, I won't add any more error handling, but if there will be more users caring about, I will add it.

[Resolved] [Q] Error when doing backup in TWRP

I tried doing a backup and it fails each time on backing up system (either that or finishes it and fails straight after)
The log is attached. (I deleted previous backup info from it so it will fit the allowed size for upload, if its important tell me i'll divide the file)
The error message reads:
E:tar_open error opening ''
E:Error creating tar '' for thread 0
I:ERROR tarList for thread ID 0
E:Error creating backup.
I:createTarFork() process ended with ERROR=255
Click to expand...
Click to collapse
How can I fix this?
[edit]
 @xanthrax gave me the solution: enable compression

createTarFork() process ended with ERROR: 255 on backup

Hiya XDA, So i'm trying to back up my phone (Running CM13) to my memory stick, and it worked before, but now it seems to have broken and I don't know what the issue is. My log (adb pull /tmp/recovery.log) is below
Heres what I've tried
Reflashing TWRP
Going to a slightly older version (3.0.2-1)
Enabling and disabling encryption
with and without compression
Skipping MD5 and leaving it on
[BACKUP STARTED]
* Backup Folder: /usb-otg/TWRP/BACKUPS/ENU7N15A10005575/2016-12-10--16-58-06_cm_angler-userdebug_6.0.1_MOB30Z_b4fbca03c0/
Backing up Boot...
I:Reading '/dev/block/mmcblk0p34', writing '/usb-otg/TWRP/BACKUPS/ENU7N15A10005575/2016-12-10--16-58-06_cm_angler-userdebug_6.0.1_MOB30Z_b4fbca03c0/boot.emmc.win'
Iartition Backup time: 4
Backing up System...
Error opening: '/system/addon.d' (Not a directory)
I:Error in Generate_TarList!
Error creating backup.
I:InfoManager saving '/usb-otg/TWRP/BACKUPS/ENU7N15A10005575/2016-12-10--16-58-06_cm_angler-userdebug_6.0.1_MOB30Z_b4fbca03c0/system.info'
createTarFork() process ended with ERROR: 255
Backup Failed. Cleaning Backup Folder.
I:Copying file /tmp/recovery.log to /usb-otg/TWRP/BACKUPS/ENU7N15A10005575/recovery.log
I:Set page: 'action_complete'
Iperation_end - status=1
E:error opening '/usb-otg/LOST.DIR' -- error: No such file or directory
E:error opening '/usb-otg/TWRP' -- error: No such file or directory
Looks as though your memory stick isn't formatted correctly. Try Fat32 or possibly EXT4
It is Fat32?
frap129 said:
Looks as though your memory stick isn't formatted correctly. Try Fat32 or possibly EXT4
Click to expand...
Click to collapse
I don't have access to a Linux machine, but I could format it in my phone?
I'll try that. and will post any updates.
UPDATE:
Formatted it in Android, still same error
UPDATE 2:
Tried a different USB stick, same error.
The USB sticks I am using are:
amazon.com/SanDisk-Cruzer-Orbit-Drive-SDCZ58-032G-B35/dp/B00BPHTH4C
and
amazon.com/SanDisk-Ultra-Flair-Performance-SDCZ73-064G-G46/dp/B015CH1NAQ/
Remove /system/addon-d in twrp ?
Will my phone work properly after doing that?
UPDATE:
Renamed it to addon-dee in my prefered Filemanager (ES) and it's backing up now.
(thank god I decided to use a USB3 stick this time)
UPDATE 2:
Phone backed up and now is working fine! thanks.
I was having the same error until I updated TWRP to the unofficial 3.0.2-3
I have this problem and l have 17g free space in my internal storage but receive error 255 and i don't find addon in my storage plz help me for fixing this error
Sent from my Le X820 using XDA-Developers mobile app
m890 said:
I have this problem and l have 17g free space in my internal storage but receive error 255 and i don't find addon in my storage plz help me for fixing this error
Sent from my Le X820 using XDA-Developers mobile app
Click to expand...
Click to collapse
Should be under /system/ . Are you rooted? I don't know if you can see that part of system if you're not rooted.
My device is rooted but this file isn't there.
Sent from my Le X820 using Tapatalk
m890 said:
I have this problem and l have 17g free space in my internal storage but receive error 255 and i don't find addon in my storage plz help me for fixing this error
Sent from my Le X820 using XDA-Developers mobile app
Click to expand...
Click to collapse
It's not always the same file. Look at your log to see which file/dir is problematic.
SOLVED createTarFork() process ended with ERROR=255
SOLUTION
This solution worked on my Zenfone 3, running lineage Android 7.1.2.
I tried many other things, like flashing different versions of TWRP, deleting the recovery directory, renaming files and all the like.
You may deselect compression, change the TWRP-date / time : nothing works !
You need an PC / Notebook with adb installed.
- start your phone in recovery-mode (TWRP)
- connect to PC and get the recovery.log with following adb command
adb pull /tmp/recovery.log
You will find a copy of the file recovery.log in the directory, from which you started the command
- open an editor or choose your favourite file viewer to open recover.log
- search for the last entry of the word "Error"
- in the line before that, the recovery.log states the name of the file that causes the problem
(in my case it was /system/addon.d)
- disconnect phone from PC.
- restart your phone in "normal" restart (do NOT boot to recovery mode)
- use a root file browser (I used ES-explorer with root enabled) and navigate to that directory/file
- delete the file (which I did not do - I tried some other steps)
- restart phone
This took 3-4 minutes, but I did not delete the file addon.d right away. Instead, I did this:
step 1
navigated to /system/addon.d and copied addon.d to SD-card
step 2
in /system/ , I renamed addon.d "addon_BU.d".
This was successful. In /system/ , the only file visible was now "addon_BU.d"
step 3
tried to create a directory named addon.d inside /system/ because my recovery.log said quote\ ... system/addon.d (not a directory) ... \unquote
FAILED. The directory could not be created by ES-explorer
step 4
copied my backup file addon.d from SD-card back into its original location /system/.
This, I though, would work just fine, because I had renamed the original addon.d to addon_BU.d.
So after restoring addon.d , the only thing left to do would be delte addon_BU.d.
ES-explorer reported no error, but - surprise - there was no file "addon.d" present in /system/
The only file still there was "addon_BU.d"
well, let's go to
step 5
rename addon_BU.d back to it's original name "addon.d" using ES-explorer
FAILED.
addon_BU.d could not be renamed - this file really was screwed up big time !!!
I ended up with no addon.d - so I could have deleted it right away istead of starting my trial with step 1 ...
step 6
Anyway. Shut dowm my phone.
Rebooted my phone normally (not to recovery mode !!!)
This took considerably longer than normal - my heart rate had began to increase slightly if not to say I began to feel like a squirrel on red bull...
After roughly 3 minutes, I had a successful reboot to my OS (lineage Android 7.1.2)
step 7
Reboot again, this time to recovery mode (=TWRP)
and: backups work again.
Don't ask me why this worked and if it will work for you, but hey, give it a triy and let me know...
TheLMGN said:
Hiya XDA, So i'm trying to back up my phone (Running CM13) to my memory stick, and it worked before, but now it seems to have broken and I don't know what the issue is. My log (adb pull /tmp/recovery.log) is below
Heres what I've tried
Reflashing TWRP
Going to a slightly older version (3.0.2-1)
Enabling and disabling encryption
with and without compression
Skipping MD5 and leaving it on
[BACKUP STARTED]
* Backup Folder: /usb-otg/TWRP/BACKUPS/ENU7N15A10005575/2016-12-10--16-58-06_cm_angler-userdebug_6.0.1_MOB30Z_b4fbca03c0/
Backing up Boot...
I:Reading '/dev/block/mmcblk0p34', writing '/usb-otg/TWRP/BACKUPS/ENU7N15A10005575/2016-12-10--16-58-06_cm_angler-userdebug_6.0.1_MOB30Z_b4fbca03c0/boot.emmc.win'
Iartition Backup time: 4
Backing up System...
Error opening: '/system/addon.d' (Not a directory)
I:Error in Generate_TarList!
Error creating backup.
I:InfoManager saving '/usb-otg/TWRP/BACKUPS/ENU7N15A10005575/2016-12-10--16-58-06_cm_angler-userdebug_6.0.1_MOB30Z_b4fbca03c0/system.info'
createTarFork() process ended with ERROR: 255
Backup Failed. Cleaning Backup Folder.
I:Copying file /tmp/recovery.log to /usb-otg/TWRP/BACKUPS/ENU7N15A10005575/recovery.log
I:Set page: 'action_complete'
Iperation_end - status=1
E:error opening '/usb-otg/LOST.DIR' -- error: No such file or directory
E:error opening '/usb-otg/TWRP' -- error: No such file or directory
Click to expand...
Click to collapse
1gnc said:
SOLUTION
This solution worked on my Zenfone 3, running lineage Android 7.1.2.
I tried many other things, like flashing different versions of TWRP, deleting the recovery directory, renaming files and all the like.
You may deselect compression, change the TWRP-date / time : nothing works !
You need an PC / Notebook with adb installed.
- start your phone in recovery-mode (TWRP)
- connect to PC and get the recovery.log with following adb command
adb pull /tmp/recovery.log
You will find a copy of the file recovery.log in the directory, from which you started the command
- open an editor or choose your favourite file viewer to open recover.log
- search for the last entry of the word "Error"
- in the line before that, the recovery.log states the name of the file that causes the problem
(in my case it was /system/addon.d)
- disconnect phone from PC.
- restart your phone in "normal" restart (do NOT boot to recovery mode)
- use a root file browser (I used ES-explorer with root enabled) and navigate to that directory/file
- delete the file (which I did not do - I tried some other steps)
- restart phone
This took 3-4 minutes, but I did not delete the file addon.d right away. Instead, I did this:
step 1
navigated to /system/addon.d and copied addon.d to SD-card
step 2
in /system/ , I renamed addon.d "addon_BU.d".
This was successful. In /system/ , the only file visible was now "addon_BU.d"
step 3
tried to create a directory named addon.d inside /system/ because my recovery.log said quote\ ... system/addon.d (not a directory) ... \unquote
FAILED. The directory could not be created by ES-explorer
step 4
copied my backup file addon.d from SD-card back into its original location /system/.
This, I though, would work just fine, because I had renamed the original addon.d to addon_BU.d.
So after restoring addon.d , the only thing left to do would be delte addon_BU.d.
ES-explorer reported no error, but - surprise - there was no file "addon.d" present in /system/
The only file still there was "addon_BU.d"
well, let's go to
step 5
rename addon_BU.d back to it's original name "addon.d" using ES-explorer
FAILED.
addon_BU.d could not be renamed - this file really was screwed up big time !!!
I ended up with no addon.d - so I could have deleted it right away istead of starting my trial with step 1 ...
step 6
Anyway. Shut dowm my phone.
Rebooted my phone normally (not to recovery mode !!!)
This took considerably longer than normal - my heart rate had began to increase slightly if not to say I began to feel like a squirrel on red bull...
After roughly 3 minutes, I had a successful reboot to my OS (lineage Android 7.1.2)
step 7
Reboot again, this time to recovery mode (=TWRP)
and: backups work again.
Don't ask me why this worked and if it will work for you, but hey, give it a triy and let me know...
Click to expand...
Click to collapse
Hi, thank you for a fix but this is an 10 month old thread. The issue was with TWRP 3.0.2-2. Along with an EFS issue that plagued TWRP 3.0.1-2, both issues have long since been resolved.
Sent from my Nexus 5X using Tapatalk
simple and working solution :
by @yannick818
"looks like it's an error with parallel apps oder multiple users. since i do not use something like that, i just removed this user with the android terminal emulator:
su
pm remove-user 999
everything was fine after that"
I could resolve my nandroid /data backup error on my EMUI 8.0 Mediapad M5 device with those following steps:
1 - Use a correct TWRP implementation
TWRP need to access the uncyphered partition /data.
There no possibility to backup it, if TWRP does not implement deciphering user data partition.
2 - Remove all users except user 0 (the administrator)
You can verify that there is no unwanted users, looking at directory /data/user : the only subdirectory should be "0".
To remove the others users :
Remove the PrivateSpace if you have one (Settings > Security & Privacy > PrivateSpace, and tap on the garbage can).
Remove all the secondary users (Settings > Users & accounts > users, and tap on each users to delete them). Keep just the main administrator user.
On EMUI, remove all twins applications (Settings > Apps & Notifications > App Twin, and disable all twin apps).
On OxygenOS, remove all parallel apps (Settings > Apps > Parallel Apps, and disable all parallel apps).
On MIUI, remove all dual apps (Settings > Dual Apps, and disable all dual apps)
On others devices ... you must find all parameters that create those unwanted users.
If you are not able to get the correct settings to suppress those users, in last resort you can try this command : "pm remove-user user-no. (For example "pm remove-user 999").
3 - Do not forget to protect your backups by a password
This would be stupid to cipher your /data partition and keep backups of this partition unprotected.
These steps fixed the nandroid backup problem for /data partition on my Huawei Mediapad M5 device.
I post on this forum because I hope that this will be helpful for others devices owners.

Unable to backup using TWRP

Hi. I have a Moto G6 Plus (evert) phone and I currently have LineageOS 17.1-20201117 installed on it. Everything works perfectly, however, there are some updates that I'd like to install. I'm not sure whether this will remove/corrupt Magisk (or break something else), so I wanted to back up all partitions using TWRP (3.5.1) just to be on the safe side. When I first booted into TWRP, I noticed that it didn't ask for a password, which it did before I had LineageOS on my phone. But now, nothing. If I attempt to do a backup, I get an error: createtarfork() process ended with error 255. I did some googling and apparently, this could be caused because TWRP can't read some partitions. I tried an older version of TWRP (3.4), but that didn't help.
Here's the recovery.log created while trying to back up:
I:Error adding file '/data/vendor/MFYxVGEouF4EC,7Sj90vJA/JjO3E2T3tbuQVW,frUXMWA' to '/external_sd/TWRP/BACKUPS/ZY322V6SQC/2021-03-13--16-49-49_lineage_evert-userdebug_10_QQ3A200805001_e3/data.ext4.win000'
Error creating backup.
I:ERROR tarList for thread ID 0 Error creating backup.
I:InfoManager saving '/external_sd/TWRP/BACKUPS/ZY322V6SQC/2021-03-13--16-49-49_lineage_evert-userdebug_10_QQ3A200805001_e3/data.info'
createTarFork() process ended with ERROR: 255 Backup Failed. Cleaning Backup Folder.
Looks like TWRP failed to back up /data/vendor/MFYxVGEouF4EC,7Sj90vJA/JjO3E2T3tbuQVW,frUXMWA. The name looks weird. I booted back into the system and opened Total Commander, navigated to /data/vendor/, and the directory looked "normal" with "normal" subdirectories and everything. So it seems like TWRP is not decrypting the data partition.
I can also see some other errors above this one.
I:Setting up '/data' as data/media emulated storage.
I:mount -o bind '/data/media' '/sdcard' process ended with RC=0
I:mount -o bind '/data/media/0' '/sdcard' process ended with RC=0 libc: Unable to set property "ro.crypto.state" to "encrypted": error code: 0xb libc: Unable to set property "ro.crypto.type" to "file": error code: 0xb
However, I'm not sure what this means exactly.
Here's the full log: https://pastebin.com/z8cQWQ21
I'm still kinda confused about TWRP not asking for a password. Before I had LineageOS (I was using the stock ROM with encryption enabled) TWRP was asking for a password. I also tried removing the password, but the backup failed anyway (same error). Most likely because encryption is still enabled regardless of whether there's a password/PIN/pattern set up.
br0kenpixel said:
Hi. I have a Moto G6 Plus (evert) phone and I currently have LineageOS 17.1-20201117 installed on it. Everything works perfectly, however, there are some updates that I'd like to install. I'm not sure whether this will remove/corrupt Magisk (or break something else), so I wanted to back up all partitions using TWRP (3.5.1) just to be on the safe side. When I first booted into TWRP, I noticed that it didn't ask for a password, which it did before I had LineageOS on my phone. But now, nothing. If I attempt to do a backup, I get an error: createtarfork() process ended with error 255. I did some googling and apparently, this could be caused because TWRP can't read some partitions. I tried an older version of TWRP (3.4), but that didn't help.
Here's the recovery.log created while trying to back up:
I:Error adding file '/data/vendor/MFYxVGEouF4EC,7Sj90vJA/JjO3E2T3tbuQVW,frUXMWA' to '/external_sd/TWRP/BACKUPS/ZY322V6SQC/2021-03-13--16-49-49_lineage_evert-userdebug_10_QQ3A200805001_e3/data.ext4.win000'
Error creating backup.
I:ERROR tarList for thread ID 0 Error creating backup.
I:InfoManager saving '/external_sd/TWRP/BACKUPS/ZY322V6SQC/2021-03-13--16-49-49_lineage_evert-userdebug_10_QQ3A200805001_e3/data.info'
createTarFork() process ended with ERROR: 255 Backup Failed. Cleaning Backup Folder.
Looks like TWRP failed to back up /data/vendor/MFYxVGEouF4EC,7Sj90vJA/JjO3E2T3tbuQVW,frUXMWA. The name looks weird. I booted back into the system and opened Total Commander, navigated to /data/vendor/, and the directory looked "normal" with "normal" subdirectories and everything. So it seems like TWRP is not decrypting the data partition.
I can also see some other errors above this one.
I:Setting up '/data' as data/media emulated storage.
I:mount -o bind '/data/media' '/sdcard' process ended with RC=0
I:mount -o bind '/data/media/0' '/sdcard' process ended with RC=0 libc: Unable to set property "ro.crypto.state" to "encrypted": error code: 0xb libc: Unable to set property "ro.crypto.type" to "file": error code: 0xb
However, I'm not sure what this means exactly.
Here's the full log: https://pastebin.com/z8cQWQ21
I'm still kinda confused about TWRP not asking for a password. Before I had LineageOS (I was using the stock ROM with encryption enabled) TWRP was asking for a password. I also tried removing the password, but the backup failed anyway (same error). Most likely because encryption is still enabled regardless of whether there's a password/PIN/pattern set up.
Click to expand...
Click to collapse
Your current ROM uses File-based Encryption (FBE) and apparently your TWRP build does not support this. Are you using an official TWRP build? Have you seen if in the TWRP thread for your device there are other users with the same problem?

[SOLVED] Restore decrypted nandroid backup of FBE

Tried restoring a nandroid backup of the data partition with twrp.
also copied the /data/media partition back from an external copy.
when booting up the phone immediately reboots back into twrp with an error message:
Android Rescue Party...
The reported problem is:
'--reason=set_policy_failed_:/data/vendor'
the vendor partition seems to be intact and i do have a backup of it taken at the same time as the data backup, restoring it doesn't yield results..
i'm wondering if FBE is throwing it off, as the backup was taken when the phone was decrypted (within twrp) however the data on the partitions is referencing some sort of encryption key?
you may also exhibit the following error upon bootup of a restored nandroid backup.
immediately after booting, the phone reboots back into recovery.
viewing the log in twrp will show:
Android Rescue Party...
The reported problem is:
'--reason=set_policy_failed_:/data/bootchart'
1. the solution to this is editing fstab.​​under twrp or other recovery​mount /vendor from the mount icon.​​in twrp: Advanced > File Manager > /vendor/etc/fstab.qcom​select edit file under userdata, find where it says fileencryption=ice​rename fileencryption to encryptable.​​Original​
Code:
/dev/block/bootdevice/by-name/userdata /data ext4 noatime,nosuid,nodev,barrier=1,noauto_da_alloc,discard wait,check,fileencryption=ice,quota,reservedsize=512M
​​Modified​
Code:
/dev/block/bootdevice/by-name/userdata /data ext4 noatime,nosuid,nodev,barrier=1,noauto_da_alloc,discard wait,check,encryptable=ice,quota,reservedsize=512M
​save file.​
2. next delete the following directories:​
/data/unencrypted
/data/misc/vold/user_keys
3. Lastly delete any of the existing files from /data/system/ :​
locksettings.db
Gatekeeper.password.key
gatekeeper.pattern.key
locksettings.db-shm
locksettings.db-wal
recoverablekeystore.db
password.key
pattern.key
4. Reboot and re-encrypt​​
At this point rebooting from recovery will result in a running and successfully recovery backup.
one thing to note is the data and data/media partitions are at this point unencrypted
TRYING TO REINCRYPT NOW WILL FAIL to reencrypt got to settings > security > re set your pin or password for the phone
(optional) then select encryption and there will be an orange button to encrypt device.
the encryption process will take quite a while as it will reencrypt your entire phone.
The above doesn't work as it's trying to accomplish FDE, and the fstab line for encryptable=ice, isn't compatible with this.
i could not find an fstab string to follow the same option but for FBE.
​
Thanks for sharing, nice guide to disable forced FBE encryption! I think this applies to Android 12+ in general, not just OnePlus devices.
I ended up with the same problem on my Mi 10 Ultra with MIUI 13 after a /data partition restore and it was a real pain to solve ("set_policy_failed:..." rescue party error for different directories). It's strange though why it fails to set the fscrypt policy for existing directories with no policy, correct permissions and SELinux context...
(Btw: whether a fscrypt policy is applied to a directory ("is this directory encrypted?") can be checked with fscryptpolicyget in terminal.)
Unfortunately, this didn't directly solve my TWRP backup restore problem and I still had to do a manual restore, but now I can at least disable FBE and it's always nice to have actual control over the device you paid money for (you should really have control by default, but oh well...)
(Some of) the troubleshooting I did:
Like I mentioned, I first thought the issue might be with the SE linux context, so I tried running restorecon, but this didn't help - I eventually found that in init.rc, restorecon is usually already automatically run during each boot for directories under /data/... so running it manually makes no difference.
To edit /vendor/etc/fstab.qcom (or /system) on my device, I had to first disable the shared blocks EXT4 optional feature. I followed this nice guide to unpack/repack super.img. But this is missing the step for disabling shared blocks: when I tried to mount any of the unpacked images (e.g. vendor.img) as R/W, it failed with the useless generic error:
wrong fs type, bad option, bad superblock on ...
Click to expand...
Click to collapse
Then dmesg gave me another clue, but at the same time was still cryptic and not immediately helpful:
EXT4-fs (loop*): couldn't mount RDWR because of unsupported optional features (4000)`.
Click to expand...
Click to collapse
So I guess 4000 is the code for shared blocks and you can disable these with e2fsck -E unshare_blocks <your .img file or loop device> (and probably need a filesystem check with e2fsck -yf <file>). Again very annoying that these numerical feature codes are not mentioned anywhere in the e2fsck manual pages for example.
Anyway, I was finally able to either:
1. mount vendor.img on my PC (mount -o loop vendor.img /mnt/vendor) and edit the /mnt/vendor/etc/fstab.qcom right there before repacking the .img and flashing the new edited super.img to my device
or
2. just repacking the vendor.img with shared blocks disabled and size increased (resize2fs vendor.img <new size>) and flashing the new super.img without other modifications - this way /vendor can also be mounted as r/w in Android and changes made later (mount -o remount,rw /vendor).
The worst part is that in the end, even with decryption disabled and the keys deleted, the device still wouldn't boot after a /data restore from TWRP (and after multiple days spent on debugging )... I still had to manually extract the TWRP backup and move directories/files individually - thankfully no issues with app/ or data/ - I think the problem was with some files in either system/ or misc/, but idk for sure. I just manually went through and kept only what seemed important (saved wifi APs, BT devices, SMSs etc, but not saved accounts). And after this it finally booted with all my apps and (most of) my settings!
(Btw2: a TWRP/nandroid backup is apparently just a bunch of separate tar.gz files, not a split archive, so you can just extract them with for file in ../data.f2fs.win*; do echo "extracting $file..."; busybox tar -xzf $file; done)

Categories

Resources