If the userdata partitions size doesn’t account for the “crypto footer”, the option to encrypt is never enabled in the Settings even if fully charged and cord plugged.
The guide shows how to deduct the necessary bytes from the partition. It should apply to other pre-oreo devices too. Change filesystem type between ext4 and f2fs accordingly.
With resize.f2fs version 1.12.0 the tool can expand/shrink as ext4 users resize2fs already does, so if you do not start on a new device and want to keep your data, you must mount the systems partition and symlink/add to PATH the binary and diverge from the guide when doing the writing change at (3).
Interestingly across a few Harpia devices, the total sector count for the userdata-partition differed slightly, so please do the calculation (once 22998784, the other time 23248640)
- preparation
adb reboot bootloader
fastboot boot twrp.img
adb root
adb shell
- continue in the adb shell context to get sector size/count
umount /sdcard
umount /data
fsck.f2fs /dev/block/by-name/userdata | grep ^Info | grep sector
outputs:
Info: sector size = 512
Info: total sectors = 22998784 (11229 MB)
one sector is 512 bytes, we want 32kB, so 64 sectors
echo $(( 22998784 - 64 ))
22998720
- recreate partition. This will erase your data (or use resize.f2fs if you want to keep your data)
mkfs.f2fs -l data /dev/block/by-name/userdata 22998720
...
Info: format successful
reboot
Afterwards with sufficient battery load and plugged cable, the encryption option will be enabled for you to activate the process. The change is safe across /e/ OTA updates, the userdata partition stays untouched.
(This is not yet fixed upstream <=18.1 in BOARD_USERDATAIMAGE_PARTITION_SIZE in BoardConfig.mk. I can see to that. But I also don’t know if userdata partitions are expected to not be touched on sideloads, or is this up to the maintainer?)
thanks to @andrelam for the initial idea in the thread Can you encrypt your user data partition?
Documentation
Unlocked bootloaders give attackers an edge (can easily image the partitions content). Prior to Android 5 Lollipop, it was rather easy to bruteforce the encryption key (“a 6 digit PIN takes less than 10 seconds. […] a 6-letter (lowercase only) password takes about 4 hours.”) when it relied on PBKDF2. It subsequently moved to scrypt and lately a trusted execution enviornment (TEE), the latest Full Disk Encryption (FDE) key scheme. I didn’t yet look into if the harpia SoC qualifies for the TEE, it should by a quick scan of its CPU architecture and presence of a tz (trusted zone) partition.
Modern devices come to rely on file based encryption (FBE) instead.