Develop Bugs

[Q] Encryption and CWM/ Custom ROM?

Good evening (subjectively) all.
I've just recently encrypted an HD 2.* ROM on my Nexus. After encrypting the device today, it appears I have no access to the SDCard in CWR.
Can anyone give me any advice? How do I unencrypt (if I must) or fix the situation ?

My impression is that right now, you can either encrypt the device and keep it stock, or stay unencrypted if you want to mod the device/enjoy CWM. Maybe I'm wrong (I hope I am!), but I've just heard that encryption causes too much pain to be worthwhile if you want to do anything non-stock.

Rules.r said:
Good evening (subjectively) all.
I've just recently encrypted an HD 2.* ROM on my Nexus. After encrypting the device today, it appears I have no access to the SDCard in CWR.
Can anyone give me any advice? How do I unencrypt (if I must) or fix the situation ?
Click to expand...
Click to collapse
I had this problem! CWM can't see the sd card as it is encrypted. You need to do a full factory reset to remove the encryption. Google does't allow the option to decrypt yet.
Unfortunetly when you do a factory reset it wont work as it is looking for the stock bootloader to complete the wipe and it won't be able to use your existing bootloader. World of hurt!
The only way I got around this was to adb/fastboot the original stock rom. This caused me so much pain! Even then I had to do it once or twice before it fully worked.
Let me know how you get on.

Question on "Phone Encryption"

Hey guys, sorry if this has been answered somewhere else, but I just want to confirm my understanding about encryption.
I'm setting up MobileIron and TouchDown for my work email and paused when the IT policy asked me to encrypt my phone.
So, is doing encryption will make it impossible for us to flash rom, radio, any kind of flashing + impossible to do all other things in CWM - due to the partition is being locked and encrypted before the device boots up?
(I'm not good to explain it technically, hopefully you get what I mean).
Slower boot time? The only way to decrypt is to factory reset and wipe all data? Impossible to backup nandroid? etc etc...
Of course the device would be more secure from the company's security point of view, but is that it?
I'm pretty sure there's no other workaround if I want to setup my phone with work email, since of course the IT policy applies to all employees so I can't ask for an exception.
At the same time I don't want to lose my ability to flash just because of the work email, it defeats the purpose of me having Android (which is to tweak and mess with my phone).
I came from SGSII where the IT policy only enforces PIN/password/pattern requirement, or perhaps because SGSII doesn't have encryption capability.
Appreciate your comment and opinion guys.

Hopefully someone knows.

kisekio said:
Hey guys, sorry if this has been answered somewhere else, but I just want to confirm my understanding about encryption.
I'm setting up MobileIron and TouchDown for my work email and paused when the IT policy asked me to encrypt my phone.
So, is doing encryption will make it impossible for us to flash rom, radio, any kind of flashing + impossible to do all other things in CWM - due to the partition is being locked and encrypted before the device boots up?
(I'm not good to explain it technically, hopefully you get what I mean).
Slower boot time? The only way to decrypt is to factory reset and wipe all data? Impossible to backup nandroid? etc etc...
Of course the device would be more secure from the company's security point of view, but is that it?
I'm pretty sure there's no other workaround if I want to setup my phone with work email, since of course the IT policy applies to all employees so I can't ask for an exception.
At the same time I don't want to lose my ability to flash just because of the work email, it defeats the purpose of me having Android (which is to tweak and mess with my phone).
I came from SGSII where the IT policy only enforces PIN/password/pattern requirement, or perhaps because SGSII doesn't have encryption capability.
Appreciate your comment and opinion guys.
Click to expand...
Click to collapse
Once your device is encrypted you won't be able to flash roms because recovery can't see the SD when you try to flash a kernel or rom.
You can't remove the encryption through a factory reset if your device is rooted and running CWM recovery. It will fail and the phone just boots up as normal. The only way I was able to remove encryption was to ADB/Fastboot the stock images onto my Nexus.
Lastly, I noticed the phone being very slow to boot with encryption.
Until Google give the option to decrypt I won't go near encryption again. Hope this helps and answers some of your questions.

jd1001 said:
Once your device is encrypted you won't be able to flash roms because recovery can't see the SD when you try to flash a kernel or rom.
Click to expand...
Click to collapse
I assume any kind of flashing won't work with encryption, including rom, kernel, radio, circlesmod, and all other kinds of mods that require flashing from CWM.
Is that correct?
If that's the case looks like I'm not going to use my work email on my phone.

Yeah your assumptions are correct!

jd1001 said:
Once your device is encrypted you won't be able to flash roms because recovery can't see the SD when you try to flash a kernel or rom.
You can't remove the encryption through a factory reset if your device is rooted and running CWM recovery. It will fail and the phone just boots up as normal. The only way I was able to remove encryption was to ADB/Fastboot the stock images onto my Nexus.
Lastly, I noticed the phone being very slow to boot with encryption.
Until Google give the option to decrypt I won't go near encryption again. Hope this helps and answers some of your questions.
Click to expand...
Click to collapse
I'm in exactly the same situation, unfortunately found out that i can't decrypt it with factory reset after I'm already encrypted
Do you happen to know good tutorial for flashing via ADB/fastboot?
I flashed my CM10 4.1.1 using galaxy nexus toolkit

http://forum.xda-developers.com/showthread.php?t=1830108 You're welcome.

Galaxy Nexus Security

Sup all
I've seen a bunch of scattered threads about security issues...But nothing satisfying enough.
Basically, I was thinking about the encryption option we have with ICS on the GN. From what I understand, staying stock with encryption enabled is the safest way to go if you fear of ever losing your phone.
Think about it, if you lose your phone and the "thief" is smart enough, he can get your passwords and data of your the accounts you have (Facebook, Gmail, Twitter, Whatsapp, Skype, etc).
From what I understand, encryption is "kinda" incompatible with cmw. I'm not an expert, but from what I read, you can't access CWM if your phone is encrypted.
Since we obviously want to run roms for the many advantages they give over stock, there must be a way to "fix" that security hole that comes with rooting/unlocking.
Like I said earlier, I'm not expert, but couldn't there be a way to have your device encrypted and running a custom rom at the same time? Something about partitioning your internal "sdcard", or maybe doing something like this if possible
unlock/root-> Flash rom-> encrypt -> lock.
TLDR: How do you effectively keep your phone secured from any unauthorized access when running custom roms?
Thanks

Some infos
http://forum.xda-developers.com/showthread.php?p=27482516
Sent from my Galaxy Nexus using xda premium

Cerberus app.
"Long is the way, and hard, that out of hell leads up to light."

To just safely run a custom ROM: install stock recovery, re-lock the bootloader, disable USB debugging, and create a PIN/password.

crachel said:
To just safely run a custom ROM: install stock recovery, re-lock the bootloader, disable USB debugging, and create a PIN/password.
Click to expand...
Click to collapse
So basically, flash the rom and mods of choice and then restore bootloader and recovery. Easily doable with the toolkit I suppose. Do I also need to unroot to make it anymore secure?
Your answer makes me wonder, what is the benefit then of having encryption on vs locked boot/stock recovery? Couldn't you somehow access data through command lines even with locked boot and stock recovery?
Thanks

la7lou7a said:
So basically, flash the rom and mods of choice and then restore bootloader and recovery. Easily doable with the toolkit I suppose. Do I also need to unroot to make it anymore secure?
Your answer makes me wonder, what is the benefit then of having encryption on vs locked boot/stock recovery? Couldn't you somehow access data through command lines even with locked boot and stock recovery?
Thanks
Click to expand...
Click to collapse
With USB debugging turned off, you cannot issue any commands to the device using ADB via command line. With a locked bootloader, you cannot boot an insecure image to give you root access. With a stock recovery, you do not gave access to the file system. So, as long as you have a lock screen PIN, I can't see how someone can get any data off the device without JTAG or some other hardware hack.
Encryption would prevent even that, given that any data extracted via JTAG would be encrypted.
Sent from my Galaxy Nexus using Tapatalk 2

la7lou7a said:
So basically, flash the rom and mods of choice and then restore bootloader and recovery. Easily doable with the toolkit I suppose. Do I also need to unroot to make it anymore secure?
Your answer makes me wonder, what is the benefit then of having encryption on vs locked boot/stock recovery? Couldn't you somehow access data through command lines even with locked boot and stock recovery?
Thanks
Click to expand...
Click to collapse
If you disable USB Debugging and use a PIN/Password/Face Unlock/Pattern you'll be safe. To access your phone data from pc, you need USB Debugging(with MTP you can't transfer app-data) to be able to use ADB. And to enable USB Debugging, they need the password/pin/...
And then if they want to use recovery, they need to unlock the bootloader(which wipes the device).

Great. Another noobie question:
If you still have root access (with locked boot and stock recovery)
and somehow the rom doesn't boot correctly, because of something like changing the boot animation via root explorer
Without USB debug, can you still get back to a functional device?
Another way to ask the question: Does USB debug/Adb commands function only when the android os is running?
What i mean is that, in case **** happens, you can just use the toolkit to unlock (wipe)/cwm/flash again, correct?
Thanks guys

la7lou7a said:
Great. Another noobie question:
If you still have root access (with locked boot and stock recovery)
and somehow the rom doesn't boot correctly, because of something like changing the boot animation via root explorer
Without USB debug, can you still get back to a functional device?
Click to expand...
Click to collapse
Not without losing all of your data, because with USB debugging off, you would have to unlock the bootloader, which would require a wipe.
la7lou7a said:
Another way to ask the question: Does USB debug/Adb commands function only when the android os is running?
Click to expand...
Click to collapse
Correct, either the Android OS, or if you have a custom recovery (which has it enabled by default).
la7lou7a said:
What i mean is that, in case **** happens, you can just use the toolkit to unlock (wipe)/cwm/flash again, correct?
Click to expand...
Click to collapse
I always say using toolkits is a bad idea -- you should figure out how to do it by issuing commands via ADB and fastboot. But yes, your statement is generally correct.

If you truly want a custom rom to be as secure as stock, it needs to be signed with something OTHER than AOSP public test keys, not rooted, and usb debugging shut off.
Most are signed with test keys. I know BAMF Paradigm is privately signed, but I cannot vouch for others.
http://uncutandroid.com/2011/03/theyre-called-testkeys-for-a-reason/
I've been asking folks to stop using test keys for a while now (as have some hacker/cracker/security nuts), and it has fallen on mostly deaf ears. It takes a rom dev 30 seconds (if he/she is slow) to correct this.

Interesting

Factory Restore an Encrypted Galaxy S3

Model: Samsung Galaxy S3 AT&T i747
Hi!
I was forced to encrypt my galaxy s3 in order to receive corporate emails on my phone using the stock email app. However I never imagined that encrypting the phone would literally lock the memory and options to customize the phone.
I tried to root the phone to benefit from more flexibility and also debloat the phone. However during the rooting process, I could not mount /emmc/ when using ClockWorkRecovery in the startup menu. Based on what I found on the web, I figured it was due to the encryption.
I then tried to factory reset the phone to get rid of the encryption but I simply can't hard reset the phone from the OS or the startup menu. When doing the reset from the startup menu, the errors are "Can't mount /sdcard/". The reset continues but when the phone reboots, all my applications and personal data are there and the phone is still encrypted.
I read a lot about flashing a custom recovery via flashboot or ADB but I am reluctant to do it without guidance from the experts (you guys).
I deleted my corporate email account (It is my personal phone, I am not required to install exchange on it).
I tried to use an external sd card but as soon as the phone recoginizes it, I have to encrypt the card as well as a result from the corporate policies. I ejected the card and did not encrypt it.
I am new to android (long time iPhone user) and I would really appreciate your guidance on the methods to factory reset my phone or a different technique to get rid of the encryption because I am really stuck right now.

I have never encrypted an Android phone before. But maybe your response to these questions will serve as a "bump" to this thread.
1) What method did you use to encrypt the phone? Stock or 3rd party encryption?
2) Doesn't that same method also offer you the offer to unencrypt the phone?
3) If you used a stock method of encrypting the phone, then I'd assume your provider (AT&T?) tech support should be able to help you unencrypt it.

Eddie,
Thanks for your response.
1) I used stock method for encryption
2) Decrypt the phone is not possible apparently,only way is to factory restore the phone apparently
3) I went to the AT&T store and they were unable to factory restore (using the standard methods). They offered an exchange but since I purchase over the phone at a discounted price, I have to do the exchange using that method. Before shipping back the phone, I was wondering if I could fix it myself with the help of knowledgeable people.
CZ Eddie said:
I have never encrypted an Android phone before. But maybe your response to these questions will serve as a "bump" to this thread.
1) What method did you use to encrypt the phone? Stock or 3rd party encryption?
2) Doesn't that same method also offer you the offer to unencrypt the phone?
3) If you used a stock method of encrypting the phone, then I'd assume your provider (AT&T?) tech support should be able to help you unencrypt it.
Click to expand...
Click to collapse

I have never used the encryption but if the phone can turn on and is usable, cant you go into the encryption settings and turn encryption off? then you should be able to do anything (may be best to start with a factory restore first just so you have a fresh slate to work with)

1ofAKind said:
Model: Samsung Galaxy S3 AT&T i747
Hi!
I was forced to encrypt my galaxy s3 in order to receive corporate emails on my phone using the stock email app. However I never imagined that encrypting the phone would literally lock the memory and options to customize the phone.
I tried to root the phone to benefit from more flexibility and also debloat the phone. However during the rooting process, I could not mount /emmc/ when using ClockWorkRecovery in the startup menu. Based on what I found on the web, I figured it was due to the encryption.
I then tried to factory reset the phone to get rid of the encryption but I simply can't hard reset the phone from the OS or the startup menu. When doing the reset from the startup menu, the errors are "Can't mount /sdcard/". The reset continues but when the phone reboots, all my applications and personal data are there and the phone is still encrypted.
I read a lot about flashing a custom recovery via flashboot or ADB but I am reluctant to do it without guidance from the experts (you guys).
I deleted my corporate email account (It is my personal phone, I am not required to install exchange on it).
I tried to use an external sd card but as soon as the phone recoginizes it, I have to encrypt the card as well as a result from the corporate policies. I ejected the card and did not encrypt it.
I am new to android (long time iPhone user) and I would really appreciate your guidance on the methods to factory reset my phone or a different technique to get rid of the encryption because I am really stuck right now.
Click to expand...
Click to collapse
1ofaKind,
Had EXACTLY the same thing happen to me. Encrypted my S3 in order to access work exchange server. Tried CWM but cannot mount /emmc/ problem after booting into recovery. Have not tried to factory reset yet as I am wanting to learn more before I go that route. But basically I am in the same boat as you. The only difference is I was not required to encrypt an external SD card when I put it in my phone. Read about flashboot as well...maybe the only way to actually factory reset after encryption??
Sorry I cannot offer any solutions at the moment...but I will keep scouring the forums looking for a way.
If I learn something valuable, I will try to post it here to help ya out.
EDIT: Maybe you have read these threads, but there is some decent info in them. http://forum.xda-developers.com/showthread.php?t=1451655 & http://forum.xda-developers.com/showthread.php?t=1392037
good luck

Look into using Odin to restore a factory image.
Sent from my SAMSUNG-SGH-I747 using xda premium

I'm in the same boat here - had to encrypt my GS3 in order to receive corporate (Exchange Server) emails. Now can't update the OS on the phone which is more important to me than receiving corporate emails on the device.
Can someone tell me how to decrypt (UN-encrypt) the phone? Everything I've read says that a factory reset won't do it.
Please help!

CZ Eddie said:
Look into using Odin to restore a factory image.
Click to expand...
Click to collapse
Has anyone tried this? If so, did it work?

I clicked install rom from sd card in cwm selected f/w which i had copied into internal memory. Did factory reset in recovery.

Odin it back to stock.

This might be too late to help you guys, but here's what worked for me. I odined it back to stock. Then I went into recovery (volume down, power and home button) and selected wipe data/factory reset. This does of course erase all your data, so try to copy whatever you can onto a computer or something before doing this. You should end up with an unencrypted storage.

sid9102 said:
This might be too late to help you guys, but here's what worked for me. I odined it back to stock. Then I went into recovery (volume down, power and home button) and selected wipe data/factory reset. This does of course erase all your data, so try to copy whatever you can onto a computer or something before doing this. You should end up with an unencrypted storage.
Click to expand...
Click to collapse
ODIN will not recognize my phone when it is in download mode ...

tamon77 said:
ODIN will not recognize my phone when it is in download mode ...
Click to expand...
Click to collapse
After you hit start, unplug then replug the usb from the computer. I had some issues with it not recognizing it either to flash stock, but when i messed with the cord, it made the noise that i unplugged and it started working. Same thing with the root injected, only this time i fully unplugged it when the fiddling with it didnt work. Make sure you replace it into the same com port.
so, i seem to be having the same problem as all of you, only i encrypted to protect my data from agents. So, right now, i am *hopefully* :fingers-crossed: installing the root injected JB now. I had many issues. TWRP and CWM were no help, couldnt see phone to add new roms to it. ODIN was the only hope. I booted into recovery after going back to stock, did a new factory reset and am installing the stock with root. When i let it boot, it didnt go to encryption this time, but the first time i flashed the stock, it did. This is a mess to say the least.
EDIT: YEAH! done. No encryption and i got root. i used the image from here: http://forum.xda-developers.com/showthread.php?t=1968625 DLK3 worked for me. Good luck. i hope this helps. Ill be happy to explain more if you want.

tamon77 said:
ODIN will not recognize my phone when it is in download mode ...
Click to expand...
Click to collapse
ODIN (for me at least) wont see anything since im using Windows 8. On Windows 7, however, it works just fine.

Factory reset encrypted phone
hi,
I'm using CM11 as a rom.
I didn't want to reinstall stock rom, just to root it again later.
Installing updated version from external SD didn't work (updated the ROM but no decryption)
Tried to factory reset from recovery - didn't work, as the internal storage is encrypted it can't mount /sdcard/
however, from within settings menu, in backup&restore there's an option to do a factory reset - this is formatting internal memory altogether.
worked like a charm.

oxidase said:
After you hit start, unplug then replug the usb from the computer. I had some issues with it not recognizing it either to flash stock, but when i messed with the cord, it made the noise that i unplugged and it started working. Same thing with the root injected, only this time i fully unplugged it when the fiddling with it didnt work. Make sure you replace it into the same com port.
so, i seem to be having the same problem as all of you, only i encrypted to protect my data from agents. So, right now, i am *hopefully* :fingers-crossed: installing the root injected JB now. I had many issues. TWRP and CWM were no help, couldnt see phone to add new roms to it. ODIN was the only hope. I booted into recovery after going back to stock, did a new factory reset and am installing the stock with root. When i let it boot, it didnt go to encryption this time, but the first time i flashed the stock, it did. This is a mess to say the least.
EDIT: YEAH! done. No encryption and i got root. i used the image from here: http://forum.xda-developers.com/showthread.php?t=1968625 DLK3 worked for me. Good luck. i hope this helps. Ill be happy to explain more if you want.
Click to expand...
Click to collapse
I understand this is very old but I am going to make a note here in case anyone else gets into this problem. When you go back to stock, do the factory reset using the STOCK recovery. Don't install TWRP or anything else until you have cleared the encryption. At least, that's what worked for me.

[Q] Full phone encryption and performance

I've got the ToroPlus and recently just encrypted the device. I've noticed that performance has degraded, it's lost a bit of its snappiness. Anyone else experience this? I know that the encrypt/decrypt process has overhead but I didn't expect to see a noticeable difference.
Also, is there no way to turn off decryption without a full wipe?

YokoMotive said:
I've got the ToroPlus and recently just encrypted the device. I've noticed that performance has degraded, it's lost a bit of its snappiness. Anyone else experience this? I know that the encrypt/decrypt process has overhead but I didn't expect to see a noticeable difference.
Also, is there no way to turn off decryption without a full wipe?
Click to expand...
Click to collapse
I encrypted mine for a while and didn't notice much of a performance difference. I basically just got tired of having to use a password all the time.
You have to do a full wipe to remove the encryption. You can do the full-backup and restore method using ADB, though (although YMMV because it is a little buggy).

Seriously said:
I encrypted mine for a while and didn't notice much of a performance difference. I basically just got tired of having to use a password all the time.
You have to do a full wipe to remove the encryption. You can do the full-backup and restore method using ADB, though (although YMMV because it is a little buggy).
Click to expand...
Click to collapse
I figured I'd have to do a full wipe. I've got Titanium Backups, do you know if they would be rendered useless to restore from due to the fact that they were produced on an encrypted OS? I think the answer is "No," I should be able to restore from them, but I'm curious if anyone has had past experience with them...

YokoMotive said:
I figured I'd have to do a full wipe. I've got Titanium Backups, do you know if they would be rendered useless to restore from due to the fact that they were produced on an encrypted OS? I think the answer is "No," I should be able to restore from them, but I'm curious if anyone has had past experience with them...
Click to expand...
Click to collapse
+1
I encrypted on a rooted STOCK rom to add MS exchange email and even after putting a custom rom (XenonHD), it is still encrypted without my work email sync'd. I'd love to decrypt it without having to wipe if poss, not to mentioned wiping prior to installing XenonHD didn't seem to help?

YokoMotive said:
I've got Titanium Backups, do you know if they would be rendered useless to restore from due to the fact that they were produced on an encrypted OS?
Click to expand...
Click to collapse
Your titanium backups will be fine. For all tb knows, your phone is no different than a non-encrypted phone. Encryption is handled down at the storage controller and filesystem level.
DNak206 said:
+1
I encrypted on a rooted STOCK rom to add MS exchange email and even after putting a custom rom (XenonHD), it is still encrypted without my work email sync'd. I'd love to decrypt it without having to wipe if poss, not to mentioned wiping prior to installing XenonHD didn't seem to help?
Click to expand...
Click to collapse
You have to do a fast boot wipe.
Code:
fastboot erase userdata
Any other way will not clear the encryption.
Sent from my Galaxy Nexus using Tapatalk 2