Encrypt phone with FairPhone Open OS

[Smojo]

@m4lvin

I think it is the other way round: The separate password in SnooperStopper is for the encryption and the PIN or pattern for unlock is managed by android. I don’t have a separate encryption menu where I could change the encryption password.

Yes, you are right I mixed that up.

Ok, I will give it a try as soon as I have enough time for eventual troubleshooting. I will let you guys know the result.

[brab]

For the record, I just got a brand new FP2. After the initial boot in the normal OS, I did the OTA install of FP Open. Then after making sure things worked, I launched the encryption process. Everything proceeded smoothly, and it’s asking me for a password before booting.

[phonefrog]

Hello,
I got a new FP 2 and have the same problem after changing back from FP Open to the Google software. I am trying since days to solve the problem. Therefore, I read with interest a lot of info. Many thanks! But much to my regret the instruction to resize the data partition does not work.

As I am a Fairphone newcomer, sorry for the silly questions:

I would also like to test the other resizing as indicated above :
quote
e2fsck -y -f /dev/block/mmcblk0p20
resize2fs /dev/block/mmcblk0p20 6790139
unquote

But where in TWRP can i do it?

Thanks in anticipation.

[AnotherElk]

@phonefrog

I would also like to test the other resizing as indicated above :
quote
e2fsck -y -f /dev/block/mmcblk0p20
resize2fs /dev/block/mmcblk0p20 6790139
unquote

But where in TWRP can i do it?

Advanced → Terminal

[phonefrog]

It seemed to be successful because I got the info:
“The filesystem on /dev/block/mmcblk0p20 is now 6790139 blocks long”

After reboot the encryption, however, did not yet work.
Do I also have to go back to factory settings?
Via TWRP?
If via TWRP please give me a short info whether only the data partition is concerned.

Many thanks.

[AnotherElk]

@phonefrog

Do I also have to go back to factory settings?

If you’re willing to start from scratch (you will lose your data on the phone), you might as well do it right and wipe the whole phone for a really clean new install …

FP2 cannot install Fairphone Open 17.10.1

You could try the TWRP way to completely wipe the phone and make a clean install from scratch … I found that to be very helpful and reliable when trying out different OSes. Attention! This will remove the installed OS and all your data from the phone (which most things labeled “factory reset” on the Fairphone 2 will not completely do). Get TWRP running as recovery (skip this step if you have the latest version running already): Download the latest TWRP image from the “Download Links” sectio…

[maba007]

Some findings about android device encryption:

• A Factory data reset (via Settings --> Backup & reset) does not remove device encryption.
• A clean way to remove device encryption: TWRP -> Wipe -> Format Data
• When you have a TWRP-backup of an encrypted userdata partition, it is not possible to restore to an unencrypted userdata partition (boot loop). Workaround: 1. Factory data reset 2. Encrypt phone via (Settings -> Security) 3. Restore your TWRP-backup of userdata via TWRP.

Tested with twrp-3.1.1-1-fp2.img and LineageOS.

[phonefrog]

Many thanks to all for the info concerning failed encryption. I tried everything to get my phone encrypted because this is an essential factor for me since one of my phones was stolen some time ago.
I tried resizing, wiping, factory reset etc. but no success. Then I contacted Fairphone Support and also tried their advice.
Also no success! Frankly speaking I was frustrated and used the phone without encryption.

Today I found the solution occasionally. I had to buy a new micro SD card because I wanted to store my complete music collection on the card. I bought a 64 GB SanDisk card, formated it under Linux Ubuntu with FAT, inserted it and tried to encrypt.
It worked!!! My Open Fairphone is now encrypted. I do not know why it works, but I am completely happy!

[helios]

Hello.

After more than 3 hours of reading forum, flashing TWRP 3.2.1, attempts to reach recovery with Volume DOWN instead of Volume UP (cause I did not read properly) I now have:

root@FP2:/ # ls -l /dev/block/platform/msm_sdcc.1/by-name/userdata
lrwxrwxrwx root     root              1970-01-01 01:56 userdata -> /dev/block/mmcblk0p20
root@FP2:/ # tune2fs -l /dev/block/mmcblk0p20 | grep "Block count"             
Block count:              6798327

Which is four 4 KiB blocks less than:

root@FP2:/ # fdisk -l /dev/block/mmcblk0 | grep userdata                       
  20         6684672        61071326       25.9G   0700  userdata

irb(main):004:0> ( 61071326 - 6684672 ) / 8
=> 6798331

Yet still on trying to encrypt the device it still just reboots.

I then lowered the number of 4k blocks to 6798000, but it still just reboots without encrypting.

Currently there is no SD card in the device.

What else to try?

Are you aware whether Fairphone has any intention to fix up this feature? This just worked out of the box with Fairphone 1.

How I do get any exact error messages on what actually fails here? They are certainly not displayed on the screen of the phone.

Additional note: In case you have no SD card installed, you also need to umount /sdcard in order to be able to resize this partition. At least it was mounted to this partition as well here.

[fair2fair]

@helios Have you read this topic? If you have a FP2 with the new camera module, some people (including me) succeeded with the encryption by temporarily removing the camera module.

[helios]

@fair2fair

@helios Have you read this topic? If you have a FP2 with the new camera module, some people (including me) succeeded with the encryption by temporarily removing the camera module.

Thanks fair2fair. No, I did not find this. I will reply there, as I am stuck with how to do that.

[helios]

@fair2fair

@helios Have you read this topic? If you have a FP2 with the new camera module, some people (including me) succeeded with the encryption by temporarily removing the camera module.

Just as an update to this thread here: Removing the camera module did the trick for me. I then first used the twrp resize menu option for the data partition and then triggered the encryption. It completed in a few minutes with I think about two reboots.

[potato]

For me, albeit using Lineage, removing the new back camera (the small module) was enough to get it to encrypt. Didn’t need to remove the new top bar/front camera.

[mitjastachowiak]

Is it normal, that booting the encrypted phone becomes extremely slow?

I would say, my phone needs more than twice the time than before encrypting…

PS: Yes, removing the camera was the solution for me, too.

[StephanK]

Yes, booting the phone takes significantly longer when encrypted.

[Patrick1]

@sil-van

My solution was, to resize the partition

@sil-van

That means for a partition size of 6798331 * 4KB blocks, the partition needs to be resized to 6798327 * 4KB blocks.

I`m really curious how someone come to this very special solution.

[StephanK]

Maybe because not many decades ago you had to deal with block sizes, Master Boot Record, offsets etc. to get your stuff working…?

[Patrick1]

@fairdroid

Encryption failed with error: E/Cryptfs ( 237): Orig filesystem overlaps crypto footer region. Cannot encrypt in place.

@StephanK
I read some more into this topic and found the core information for your calculation.
Very tricky and I believe there are not many users ever being confronted with such a situation.
I once had such a situation when using the Smartfilesystem on a magneto optical media.
But as I always had it most filesystems are stored in the first data blocks of a media or in the header.
This encrypting filesystem is being stored in the footer which is a bit irritating to me.

[StephanK]

Yes, indeed, this is unusual although documented. I’d expect crypto headers in the beginning, too.

The calculation is not from me, by the way, but from @sil-van. He deserves the credit.

Android is such a mess that I sometimes wish that the Librem 5 will set the new benchmark for mobile operating systems. A typical linux system is much less confusing - and think about mainline support - MAINLINE!