Removing encryption from recovery

Question

I'm running CyanogenMod 12 nightly on my G900T (klte). Everything works great except for the default encryption password, which causes my phone to boot loop.

I've formatted data and done factory resets, but /data is still encrypted and shows up as /dev/dm-0.

Is there a command that I can do to remove the encryption? I don't care about the data, I want it all gone. I just want to get back to having /data and the internal storage being stored in plaintext on disk to be able to boot into CyanogenMod.

How can I use adb shell to remove the encryption on these partitions?

Answer 1

The answer for me involved a number of things, but I think one is really the key.

Use the "recovery" Command, bro

This uses CyanogenMod's/AOSP's recovery program to wipe the user data and disable encryption. (found in this answer on Stack Overflow) Boot into your recovery, and then from your computer run

adb shell recovery --wipe_data --set_filesystem_encryption=off

Your phone will reboot into system and things should hopefully work as planned.

If you need to run it from the phone itself (ie: you don't have a computer nearby to adb with):

recovery --wipe_data --set_filesystem_encryption=off

It should wipe, disable encryption, and reboot system.

If All Else Fails

Don't use this method unless the above doesn't work or apply to your scenario.

Destroy the LUKS Header for Filesystem Encryption

1. You need a recovery which will allow you to drop to a shell as root, so TWRP works in my case.
2. Locate the userdata partition by looking around in /dev/block/platform/*/by-name/userdata.

3. Write out a ton of zeroes to the beginning of that partition to wipe the LUKS header:

   dd if=/dev/zero of=$PATH_TO_YOUR_USERDATA bs=4096 count=512
   

   I claim no responsibility for what you do with this command. If you screw this up, you can brick your phone by overwriting your bootloader or other critical partitions. Make sure that $PATH_TO_YOUR_USERDATA points to the real userdata partition. Check the size of that partition to make sure you're wiping the right thing. I have a 16GB phone and userdata is 10.4GB, with the rest being dedicated to system, but your phone will be different.

4. Reformat that partition as ext4 using make_ext4fs $PATH_TO_YOUR_USERDATA.

   There might be errors, but usually they relate to not being able to find the internal "sdcard," this is okay.

After all this, reboot recovery again and then run a factory reset just to be safe.

Why Does This Work?

Simply doing a factory reset seemed to not do anything for me, the phone would still see a LUKS partition there. I assume that this is because the LUKS header still existed at the disk level and the ext4 partition was just overlaid on top of it. For some reason, Android prioritized detection of a LUKS partition over an ext4 partition and attempts (and succeeds) to mount that.

Where to Go from Here

(If you know what you're doing, you might also want to wipe system and install your ROM from scratch. Again, I take no responsibility for anything you do with the information contained in this post.)

Worked for me on a klte G900T (Samsung Galaxy S5 T-Mobile). Your mileage may vary.

Answer 2

On my Moto G 3rd Gen (osprey), neither calling recovery nor wiping LUKS header (at start and end of partition) worked - I still needed to enter the encryption password during Cyanogen Mod bootup, then was stuck with an "encryption error" message.

I finally found that my TWRP 3.0.1 recovery has a "Format Data" option in the "Wipe" section. This does a complete factory reset which also disables encryption.

Worked like a charm. If you have access to a decent TWRP version (easily flashed e.g. with Flashify), try this first.

Answer 3

Provided that you're using TWRP or similar.

• reboot to TWRP (enter password), and make a backup of Data partition to external SD or OTG Drive
• reboot to TWRP (cancel password), and format Data partition to f2fs
• restore backup made in step one to newly created Data partition
• reboot system
• enjoy Android with all your data saved, and encryption removed

Answer 4

The solution of manually wiping the LUKS header provided by Naftuli Tzvi Kay works fine, except for one thing. I do not how what it depends on, but in my experience, Android keeps the LUKS header at the END of the partition. And if that is the case with your device, then running

dd if=/dev/zero of=$PATH_TO_YOUR_USERDATA bs=4096 count=512

will fail to remove the header (footer?) because it wipes only the beginning of the partition. One could of course wipe the entire partition, but that would take unnecessarily long. So...

To wipe the end of the partition (of any size), after running the above command, run this command also:

dd bs=512 if=/dev/zero of=$PATH_TO_YOUR_USERDATA count=22048 seek=$((`blockdev --getsz $PATH_TO_YOUR_USERDATA` - 22048))

Answer 5

Are you using custom recovery?

If yes, then do this after booting to a custom recovery (TWRP in my case):

1. On recovery start, DO NOT decrypt the device. Just tap Cancel when asked of password or pattern.

2. Wipe the data partition. (On TWRP after swiping to modify system: Wipe > Advanced > Check: Data)

This will of course wipe everything in the userdata partition. The whole data partition will be reformatted including the encryption keys.

Answer 6

My votes go to @Naftuli Kay, and other helpful answer here, but I have some info I'd like to share. It's too long for a comment, let it be an answer then.

Since some version of TWRP, there's 'format data' item on Wipe screen. It not only wipes /data partition, but also handles the encrypted FS matter. In my case, TWRP 3.0.2 on Samsung J500H wipes encryption, and it was the only way, factory reset doesn't work. CMR (that one being built along my CM 12.1 rom for J500H) can't clear encryption either.

--set_encrypted_filesystem=off also didn't work in TWRP and CMR.

wiping data via OpenRecoveryScript https://twrp.me/faq/openrecoveryscript.html also doesn't work

Android 3.0 started to map /sdcard to /data/media, so they had to rework /data wipe to not /data/media, and rm -rf is performed instead. See https://twrp.me/faq/datamedia.html for more details.

When you perform 'format data' you may see in recovery log (/cache/recover/log or /cache/recovery/last_log) following info:

I:Successfully wiped crypto footer.

before it formats /data with make_ext4fs. The TWRP code has number of checks to find where the LUKS header is, and in my case it found it in the footer.

I looked at the TWRP source and I haven't found a way to 'format data' from command line (I need to wipe encrypted storage from an application in custom rom), so this option is present in UI only. With the only exception - if TWRP is compiled with TW_OEM_BUILD enabled then it will 'format data' on factory reset, clearing crypto header and formatting data partition, otherwise it would use regular wipe w/o formatting.

I'm going to try to dd with zeros, actually TWRP does the same to clear encryption, just it knows where to look for the header exactly ))

Answer 7

Expanding on Naftuli Tzvi Kay's answer above...

well, that answer got me to the right place, but my phone (CM11 / i9300) didn't have a recovery command, and the wipe command didn't have an option to disable encryption. So I did it manually from looking at the comments in the source code for the recovery command (file linked from the answer linked in the above question):

* The recovery tool communicates with the main system through /cache files.
* /cache/recovery/command - INPUT - command line for tool, one arg per line
* /cache/recovery/log - OUTPUT - combined log file from recovery run(s)
* /cache/recovery/intent - OUTPUT - intent that was passed in
*
* The arguments which may be supplied in the recovery.command file:
* --send_intent=anystring - write the text out to recovery.intent
* --update_package=path - verify install an OTA package file
* --wipe_data - erase user data (and cache), then reboot
* --wipe_cache - wipe cache (but not user data), then reboot
* --set_encrypted_filesystem=on|off - enables / diasables encrypted fs
*
* After completing, we remove /cache/recovery/command and reboot.

So to do it manually (with adb):

1. get up a prompt with root access, e.g.

   $ adb shell
   > su
   

2. put the following text into the file /cache/recovery/command, either with echo or vi:

   --wipe_data
   --set_encrypted_filesystem=off
   

   e.g. with echo -e "--wipe_data\n--set_encrypted_filesystem=off" > /cache/recovery/command

3. reboot into CWM or similar recovery

You should see a nice progress bar and it should get done :)

Answer 8

The best working method is to boot into TWRP and use the inbuilt terminal to format it as ext2(coz that's the only thing supported from terminal directly), and change the partition to ext4 using the "Repair Filesystem" Option under Mount

To format as ext2:

mkfs.ext2 /dev/block/mmcbl0p23 (Substitute with the value of your userdata partition by looking around in /dev/block/platform/*/by-name/userdata )

Change filesystem as ext4:

Wipe -> Advanced Wipe -> Select "Data" ->Repair or Change FileSystem -> Change File System -> EXT4

Now, you should have encryption removed, and be able to mount /data partition from TWRP. Hope this helps :)