Database Develop

Workaround: how to use full device encryption with custom recovery and newer ROMs.

Starting with Android L/Lollipop/5.0, full device encryption will be enabled by default, and for good reason. However, we slightly more security-conscious/paranoid SGS3 users have had problems for a while with using custom ROMs and keeping our encryption, as the main custom recovery with support for encryption --- TWRP --- has some incorrect build flags and other problems that aren't considered a priority. However, thanks to the very same bug report and discussion on the issue on TWRP's pages, someone found a solution which I can confirm works for me as well: https://github.com/TeamWin/Team-Win-Recovery-Project/issues/247#issuecomment-52651670
One option would be to check whether CWM Recovery supports your device. Then you'll have access to MiniVold in recovery mode and you can mount encrypted partitions through adb. I prefer the TWR method of just typing in my password, but as long as that does not work on my Galaxy S3, this does:
adb shell
setprop ro.crypto.state encrypted
vdc cryptfs checkpw 'your passphrase here'
mount /dev/block/dm-0 /data
and when you're done backing up/installing a zip
umount /data
Click to expand...
Click to collapse
For Windows users, here's a batch file you can use to automate this process:
Code:
adb shell setprop ro.crypto.state encrypted
adb shell vdc cryptfs checkpw "%~1"
adb shell mount /dev/block/dm-0 /data
Save it under whateveryouwant.bat and then give it the password as a parameter (if the password contains spaces, enclose it in quotes).
Caveat: I've found some operations will unmount /data, which for some reason cannot then be re-mounted by any combination of these commands. Workaround is to just reboot Philz Touch Recovery / CWM Advanced Recovery, re-mount, and continue.

TWRP 2.8.7 on Lolipop stock (just prerooted) can't mount encrypted system

I think the title says it all. On a almost totally stock z3c, TWRP can't access an encrypted /system - it asks for the pattern, but just says says the pass pattern'failed'. Changing to a PIN didn't help.
Recovery.log says:
Code:
E:Failed to decrypt data.
I:Set page: 'decrypt'
I:operation_end - status=1
I:Set page: 'trydecrypt'
I:operation_start: 'Decrypt'
Warning: crypto footer minor version 4, expected <= 3, continuing...
has_hw_crypto is 0
crypt_ftr->fs_size = 24719295
Using scrypt for cryptfs KDF
Enabling support for allow_discards in dmcrypt.
load_crypto_mapping_table: target_type = crypt
load_crypto_mapping_table: real_blk_name = /dev/block/mmcblk0p25, extra_params = 1 allow_discards
Error temp mounting decrypted block device '/dev/block/dm-0'
crypt_ftr->fs_size = 24719295
Using scrypt for cryptfs KDF
Enabling support for allow_discards in dmcrypt.
load_crypto_mapping_table: target_type = crypt
load_crypto_mapping_table: real_blk_name = /dev/block/mmcblk0p25, extra_params = 1 allow_discards
Error temp mounting decrypted block device '/dev/block/dm-0'
E:Failed to decrypt data.
I:Set page: 'decrypt'
I:operation_end - status=1
Is there an alternative build of TWRP I need or something ? The TWRP 3.x release thread makes it look like it's in no shape to try.

So, TWRP 2.x doesn't support it. See http://forum.xda-developers.com/z3/development/z3-twrp-2-8-7-0-d6603-t3273996 which is trying to make a build that does.

TomChiverton said:
I think the title says it all. On a almost totally stock z3c, TWRP can't access an encrypted /system - it asks for the pattern, but just says says the pass pattern'failed'. Changing to a PIN didn't help.
Recovery.log says:
Code:
E:Failed to decrypt data.
I:Set page: 'decrypt'
I:operation_end - status=1
I:Set page: 'trydecrypt'
I:operation_start: 'Decrypt'
[B]Warning: crypto footer minor version 4, expected <= 3, continuing...[/B]
has_hw_crypto is 0
crypt_ftr->fs_size = 24719295
Using scrypt for cryptfs KDF
Enabling support for allow_discards in dmcrypt.
load_crypto_mapping_table: target_type = crypt
load_crypto_mapping_table: real_blk_name = /dev/block/mmcblk0p25, extra_params = 1 allow_discards
Error temp mounting decrypted block device '/dev/block/dm-0'
crypt_ftr->fs_size = 24719295
Using scrypt for cryptfs KDF
Enabling support for allow_discards in dmcrypt.
load_crypto_mapping_table: target_type = crypt
load_crypto_mapping_table: real_blk_name = /dev/block/mmcblk0p25, extra_params = 1 allow_discards
Error temp mounting decrypted block device '/dev/block/dm-0'
E:Failed to decrypt data.
I:Set page: 'decrypt'
I:operation_end - status=1
Is there an alternative build of TWRP I need or something ? The TWRP 3.x release thread makes it look like it's in no shape to try.
Click to expand...
Click to collapse
Hi,
as @TomChiverton says I'm working on it. So I install slimrom which seems to be a modified sony stock rom. With my custom build I successful decrypt cyanogenmod but this rom cause a lot of troubles.
I found your post when looking for information about crypto footer version 1.4 which seems doesn't exist.... Even in the L version! In my opinion this crypto footer is a proprietary implementation of sony but maybe I am wrong. Did you have any information on this?
@TomChiverton which rom did you use on your phone? Have you an unlocked/old/new bootloader? Are you ok to tests build for z3c?
Thanks for your time.

Restore data on Xiami Mi A2 (Android 9)

I'm trying to unlock to my bootloader folowing this guide: media-max.eu/unlock-bootloader-on-xiaomi-a1-and-a2-without-losing-data/. Now I have unlocked bootloader, but I can't reboot into OS. I see this message: Can't load Android System. Your data may be corrupt. When I booting into twrp
Code:
fastboot boot recovery.img
data partition is not empty. /data/unencrypted/key folder is exists. But when I try to decrypt the data partition with twrp, I get this error:
Code:
e4crypt_initialize_global_de
calling retrieveAndInstallKey
Key exists, using: /data/unencrypted/key
Using Keymaster HAL: 3 from QTI for encryption. Security level: TRUSTED_ENVIRONMENT, HAL: [email protected]::IKeymasterDevice/default
begin failed, code -62
Upgrading key in memory only: /data/unencrypted/key
upgrade_key failed, code 1
e4crypt_initialize_global_de returned fail
e4crypt_initialize_global_de
calling retrieveAndInstallKey
Key exists, using: /data/unencrypted/key
Using Keymaster HAL: 3 from QTI for encryption. Security level: TRUSTED_ENVIRONMENT, HAL: [email protected]::IKeymasterDevice/default
begin failed, code -62
Upgrading key in memory only: /data/unencrypted/key
upgrade_key failed, code 1
e4crypt_initialize_global_de returned fail
And when I'm manualy typing
Code:
twrp decrypt 123456789
I have this:
Code:
I:operation_start: 'TWRP CLI Command'
E:Unexpected value for crypto key location
E:Error getting crypt footer and keyE:Could not get footer
I know my gesture key. Can I decrypt and restore my data partition?
Sorry for mistakes. English it's not my native language.

I have exactly same issue i also unlocked bootloader that way, did you solve it or at least figure out why it happens? I want to know if data is still recoverable.

TWRP commandline backup problems

Hi.
I'm trying to backup data partition with cmdline due to a broken display (currently, LOS 17.1 is installed). However it doesn't work. It seems to having issues with /data/system_ce/0. Can anyone help? The backup worked with via display in the past. Here is some logfile output:
Code:
[BACKUP STARTED]
* Backup Folder: /data/media/0/TWRP/BACKUPS/84a0237/2021-05-22--19-20-37
Invalid encryption mode 'ice:aes-256-cts'
Backing up Data...
Backups of Data do not include any files in internal storage such as pictures or downloads.
Invalid encryption mode 'ice:aes-256-cts'
Breaking backup file into multiple archives...
I:Creating backup...
I:Creating tar file '/data/media/0/TWRP/BACKUPS/84a0237/2021-05-22--19-20-37/data.ext4.win000'
I:addFile '/data/server_configurable_flags' including root: 1
==> set selinux context: u:object_r:server_configurable_flags_data_file:s0
found policy '/data/server_configurable_flags' - '1DK' - 'c0cd60c87b2b4dfc'
I:addFile '/data/system_ce' including root: 1
==> set selinux context: u:object_r:system_data_file:s0
I:addFile '/data/system_ce/0' including root: 1
==> set selinux context: u:object_r:system_data_file:s0
failed to lookup tar policy for '/data/system_ce/0' - '1435bb0a12e56a60'
I:Error adding file '/data/system_ce/0' to '/data/media/0/TWRP/BACKUPS/84a0237/2021-05-22--19-20-37/data.ext4.win000'
Error creating backup.
I:ERROR tarList for thread ID 0
Error creating backup.
I:InfoManager saving '/data/media/0/TWRP/BACKUPS/84a0237/2021-05-22--19-20-37/data.info'
createTarFork() process ended with ERROR: 255
Backup Failed. Cleaning Backup Folder.
I:Copied file /tmp/recovery.log to /data/media/0/TWRP/BACKUPS/84a0237/2021-05-22--19-20-37/recovery.log
Backup Failed
The device uses FBE, but users are decrypted successfully:
Code:
User 0 Decrypted Successfully
I:All found users are decrypted.
Data successfully decrypted
I can pull data from every folder. Maybe it is an idea to pull the data manually? But which data/folders should be pulled?
Thanks everybody in advance for some responses and help.

How To Guide How to "fix" the error Cannot load Android system. Your data may be corrupt.

If a serious error occurs when booting Android, Android boots the phone from the recovery installed on the phone. The standard Android recovery then aborts the boot process with an error message similar to this one:
Cannot load Android system. Your data may be corrupt.
and the only options to continue are "Try again" or "Factory data reset".
The error message is not really useful and most documentation on the Internet that I found recommends a factory reset to fix the problem. In most cases, factory reset works, but it has the disadvantage that you lose all the settings and data on the phone. So in most cases this is the worst option.
However, if the error is not caused by an invalid or missing file in the partitions for /data or /metadata, resetting to factory defaults will not fix the problem, but the data from the phone will still be gone.
Therefor I wrote this little HowTo.
This HowTo is not about how to fix that error -- it only contains some hints to find the reason for the error.
To get more information about the error and also the possibility to backup the phone's data, TWRP can be used:
Just poweroff the phone, reboot the phone into the bootloader, and then reboot the phone from the TWRP image, e.g:
Bash:
sudo fastboot boot /data/backup/ASUS_ZENFONE8/twrp/twrp-3.7.0_12-0-I006D-enhanced.img
Note:
In most cases, there is no option to turn off the phone in this dialog, so the phone must be turned off using the phone keys.
The key combination to turn off the phone during this dialog depends on the phone; on an ASUS Zenfone 8, this key combination must be used:
Press Volume UP + Volume DOWN + Power for 20 or more seconds
After the phone booted into the TWRP image connect via adb to the phone and check the TWRP logfile for a more detailed error message. The logile used by TWRP is /data/recovery/log.gz. Search for the string "Android Rescue Party trigger" in the TWRP logfile.
Note:
/data/recovery/log.gz is a compressed file ; use gzip to uncompress it.
Example:
Code:
ASUS_I006D:/ # gzip -cd /data/recovery/log.gz | more
Starting TWRP 3.7.0_12-0-d07fdb3c on Sat Jan 10 00:53:15 1970
(pid 403)
I:Lun file '/config/usb_gadget/g1/functions/mass_storage.0/lun.0/file'
PRODUCT_USE_DYNAMIC_PARTITIONS := true
TW_INCLUDE_CRYPTO := true
I:TW_BRIGHTNESS_PATH := /proc/lcd_brightness
I:Found brightness file at '/proc/lcd_brightness'
I:TWFunc::Set_Brightness: Setting brightness control to 420
I:TW_EXCLUDE_ENCRYPTED_BACKUPS := true
I:LANG: en
I:AB_OTA_UPDATER := true
Starting the UI...
Skipping adf graphics -- not present in build tree
setting DRM_FORMAT_XBGR8888 and GGL_PIXEL_FORMAT_RGBA_8888
setting DRM_FORMAT_XBGR8888 and GGL_PIXEL_FORMAT_RGBA_8888
....
I:Switching packages (TWRP)
boot command: boot-recovery
I:Startup Commands:
Android Rescue Party trigger! Possible solutions? Either:
1. Wipe caches, and/or
2. Format data, and/or
3. Clean-flash your ROM.
The reported problem is:
'--reason=set_policy_failed:/data/misc'
'--reason=set_policy_failed:/data/misc'
ro.boot.bootreason=shutdown
ro.boot.id.rf=1
If the error message is still not helpful in finding the reason for the error, try a Google search.
And if a factory reset is necessary, you can at least back up your data on the phone before performing the reset.
More infos about Android Rescue Party Trigger
The Android Rescue Party Trigger is an error handling process from Android (see here for more details about this Android functionality)
Android Rescue Party Trigger can also be triggered by Android while the OS is running :
In this case there should be some additional messages in the logfile /data/system/uiderrors.txt.
In addition, and if Magisk is installed, it might be useful to write the logcat messages to a file using the script from this post:
https://gist.github.com/niikoo/3f6bd13a69f2d68f3dd51cc667e79bdc
File: /data/adb/post-fs-data.d/0001logcatboot
Code:
#!/system/bin/sh
mkdir -p /cache/logs
/system/bin/logcat -r 1024 -n 9 -v threadtime -f /cache/logs/log >info.log 2>err.log &
The script can also be "installed" after the error already occured, to do this:
Boot the phone from the TWRP image; copy the script to the directory /data/adb/post-fs-data.d; make it executable and reboot the phone again from the installed OS to trigger the error again.
Note that logcat is not yet running if the error occurs in the early boot phase.
Caution:
If possible, TWRP will mount /data into the partition used for /data in the Android OS. Therefore, you can view the recovery boot logs in /data/recovery even after restarting the Android operating system as the user root.
However, if mounting the partition for /data in TWRP does not work, /data will be a directory in the root file system, e.g.:
Code:
130|ASUS_I006D:/ # df -h /data
Filesystem Size Used Avail Use% Mounted on
rootfs 3.2G 101M 3.1G 4% /
ASUS_I006D:/ #
In this case the contents of /data/reocvery are lost after rebooting the phone!
Notes:
The Android kernel uses the device /dev/block/by-name/misc to store the kernel parameter for the recovery kernel. The kernel from the recovery TWRP will clean the device /dev/block/by-name/misc . Therefor the error message is only visible in the logs of the first boot of TWRP.
The active log file for TWRP is /tmp/recovery.log; you can also use that file for the checks. Note that /tmp is mounted on a ramdisk.
On the page https://source.android.com/docs/core/tests/debug/rescue-party are instructions to force an Android Rescue Partry trigger by setting some properties but I did not get that to work neither in the OmniROM 13 nor in the ASUS Android 12.
To avoid the reboot from the TWRP image, install the TWRP recovery on the phone. In this case, Android will automatically boot into the installed TWRP recovery when a fatal error occurs.