1

My oneplus 3T running Oxygen OS 9.0.6 (Android 9) came with full system encryption by default.

I want to install root but also keep full system encryption.

  • Will root disable encryption?
  • Does root allow to bypass encryption / lock screen with adb or some other method? (I. e. in any case)
  • I am familiar with the half-baked Android system backup feature. is there a way to root the phone without a factory reset? if not, what is the best way to create a system image or similar so I don't have re-install and configure everything over again?
  • what is the difference between system and systemless root?
  • 2
    I have never heard of "full system encryption", I only know full disk encryption (FDE) and file based encryption (FBE) - both encrypt only user data. Android 9 usually uses FBE - you should make sure which method is use don your device: android.stackexchange.com/questions/195713/… In any way you should not ask multiple unrelated questions in one post. – Robert Feb 3 at 15:05
3
  • no, rooting does not affect encryption
  • encryption remains safe. depending on user (who is responsible for granting root access) it is not vulnerable as long as malicious app has no root permissions
  • rooting does no factory reset. once rooted, the simplest straight forward backup method is (FDE)
    adb pull /dev/block/dm-0
  • rooting system is outdated. systemless root does it's stuff without modifying system (to preserve functionality)

However, the answer becomes invalid when we are talking about unlocked bootloader

  • attacker can flash modified boot or recovery
  • TWRP may able to decrypt userdata partition without asking for credentials when FDE uses default_password (which seems the case for you)
  • attacker can inject scripts without having access to encrypted userdata, which can wait for the user unlocks it's device and then gain access to decrypted userdata. for FBE it is possible to modify credentials (not the case for you)
  • unlocking bootloader requires factory reset. your only chance for full backup would be a rooting method without unlocking bootloader, which is afaik only available for Mediatek devices and for the Galaxy S9 and Note 9. you rely on common (non-root) backup solutions
| improve this answer | |
  • default_password can be changed. disable forceencrypt, format data, set screen lock, encrypt again. after this TWRP ask for screen lock credentials – alecxs Feb 3 at 21:03
  • I am confused: 1) how do I change default_password (FDE) to prevent access to userdata and do I need a custom rom to do that or Oxygen OS (default system) works?, 2) "attacker can inject scripts without having access to encrypted userdata..." -> does this refer to MALICIOUS root apps or to anyone with physical access to the phone and, if I understand correctly, I still need to unlock my phone? – dragonmnl Feb 9 at 12:06
  • 1) see comment 2) physical access only, yes – alecxs Feb 9 at 14:41
  • thank you. one last question, then I will happily accept your answer : rooting requires unlocking the bootloader if I understand correctly. if that's the case, what are the implications for RE-locking it? I've heard of soft bricks with encryption and such, a bit concerning. Not sure if those comments were about systemless though. the purpose of RE-locking is obviously to increase security – dragonmnl Feb 9 at 15:39
  • yes, unlocking is required. before locking bootloader all partitions must reversed to official state, otherwise it may hard-brick – alecxs Feb 9 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.