There is a prior question that answers this for Android 3.0 but some stuff I have read elsewhere has said that installing TWRP will not work with encryption in more recent versions of Android, so I wanted to double check and see if anyone here knows for sure.
I plan to unlock the bootloader on my device (Droid Razr HD xt926, there's an exploit and I'm rooted, frozen at 4.1.2 with the proper system version to do this) in order to flash a custom ROM (probably CM11 to start) and breathe some new life into this tiny computer.
I understand most of the concepts involved in this process as far as using adb and fastboot to flash the custom recovery/ROMs onto my device and have found a tool on another site to flash the KitKat firmware directly in order to use 4.4-based ROMS. However, I have not gone ahead because I want to make sure first that I will be able to encrypt my data again, since I know that the unlocked bootloader is kind of a security hazard.
In my understanding (verified by the link above in reference to Honeycomb devices), it should not be an issue so long as the external SD card is not encrypted so that software can be pushed and installed by the custom recovery, because this isn't true FDE and only a partition with your data is encrypted, not the entire disk. Has this changed?
I do not expect to be faced with a very sophisticated attacker, so I am not that worried about someone taking advantage of the unlocked bootloader in order to dump everything and bruteforce my PIN. It's more that I just live in a place where mugging and phone theft is not uncommon and I don't want a "regular" thief to have easy access to my messages and accounts and such.
So: Will the 4.4 disk encryption scheme work with a custom recovery? With all custom recoveries? And do I need to seek out particular ROMs that have fde available, or is it a standard part of Android that remains regardless of other developer tweaks and theming?