[HOWTO] Moto G4 Play "Harpia" - encrypt userdata partition fix

If the userdata partitions size doesn’t account for the “crypto footer”, the option to encrypt is never enabled in the Settings even if fully charged and cord plugged.

The guide shows how to deduct the necessary bytes from the partition. It should apply to other pre-oreo devices too. Change filesystem type between ext4 and f2fs accordingly.

With resize.f2fs version 1.12.0 the tool can expand/shrink as ext4 users resize2fs already does, so if you do not start on a new device and want to keep your data, you must mount the systems partition and symlink/add to PATH the binary and diverge from the guide when doing the writing change at (3).

Interestingly across a few Harpia devices, the total sector count for the userdata-partition differed slightly, so please do the calculation (once 22998784, the other time 23248640)

  1. preparation
adb reboot bootloader
fastboot boot twrp.img
adb root
adb shell
  1. continue in the adb shell context to get sector size/count
umount /sdcard
umount /data
fsck.f2fs /dev/block/by-name/userdata | grep ^Info | grep sector


Info: sector size = 512
Info: total sectors = 22998784 (11229 MB)

one sector is 512 bytes, we want 32kB, so 64 sectors

echo $(( 22998784 - 64 ))
  1. recreate partition. This will erase your data (or use resize.f2fs if you want to keep your data)
mkfs.f2fs -l data /dev/block/by-name/userdata 22998720
Info: format successful


Afterwards with sufficient battery load and plugged cable, the encryption option will be enabled for you to activate the process. The change is safe across /e/ OTA updates, the userdata partition stays untouched.

(This is not yet fixed upstream <=18.1 in BOARD_USERDATAIMAGE_PARTITION_SIZE in BoardConfig.mk. I can see to that. But I also don’t know if userdata partitions are expected to not be touched on sideloads, or is this up to the maintainer?)

thanks to @andrelam for the initial idea in the thread Can you encrypt your user data partition?


Unlocked bootloaders give attackers an edge (can easily image the partitions content). Prior to Android 5 Lollipop, it was rather easy to bruteforce the encryption key (“a 6 digit PIN takes less than 10 seconds. […] a 6-letter (lowercase only) password takes about 4 hours.”) when it relied on PBKDF2. It subsequently moved to scrypt and lately a trusted execution enviornment (TEE), the latest Full Disk Encryption (FDE) key scheme. I didn’t yet look into if the harpia SoC qualifies for the TEE, it should by a quick scan of its CPU architecture and presence of a tz (trusted zone) partition.

Modern devices come to rely on file based encryption (FBE) instead.


I was unaware that (some versions of?) TWRP for each device can do the shrink for the crypto footer user friendly by way of reformating the userdata partition.

It’s mentioned as workaround in some of the backlog issues (backlog#1497, backlog#174, backlog#1180)

Go into TWRP > Wipe > Advanced Wipe > select Data > Repair or Change File System > Resize File System > swipe to confirm.

self reply → I think it is best to convert this to a update-binary script similar to copy_partitions.zip for a/b devices. That script used GitHub - Lanchon/Flashize: Turn Shell Scripts Into Flashable Android Recovery Zips in the header. Not really necessary to use it, just having the folder structure + 2 scripts is sufficient, the idea is to give users a sideloadable script outside the normal update process.