How to decrypt Island / Work profile and Parallel Apps user in TWRP?

Question

TWRP 3.4.0.0 release introduced multiuser decryption which means no more error 255 or other multiuser backup errors on devices with multiple users setup. The problem is, TWRP requires all the users to be decrypted in order for the backup to be successful. But, I can't seem to decrypt Island / Work profile user (user 11) and Parallel apps user (user 999) in my OnePlus 6 running Android 10.

Note: Parallel apps user is specific to OnePlus devices.

Here's what happens when I enter my PIN in TWRP on boot or through command-line:



Attempting to decrypt data partition or user data via command line.

Attempting to decrypt FBE for user 0...

User 0 Decrypted Successfully

Attempting to decrypt FBE for user 10...

Failed to decrypt user 10

Attempting to decrypt FBE for user 11...

Failed to decrypt user 11

Attempting to decrypt FBE for user 999...

Failed to decrypt user 999

Data successfully decrypted

Updating partition details...

...done

I can explicitly decrypt secondary user 10, so no problem there, but I am unable to do that for Work Profile / Island user and Parallel Apps user (user 999).

Doing twrp decrypt MY_PIN_FOR_USER_0 999 doesn't work. Running locksettings verify --user 11 and locksettings verify --user 11 gives me

Profile uses unified challenge

So, how do I decrypt these user accounts so that I can make TWRP backups?

I am unable to put the answer to this question to my use. What is a "synthetic password" and how is it used by Android?

Edit: From the TWRP issue tracking link shared by alexcs, the solution for work profile is to separate its lockscreen credentials from the primary/main user. This seems to work so far. However, it doesn't not work for decrypting parallel apps user (999).

— Firelord | Sources

Answer

Note: this solution is tested on Android 10 (OxygenOS 10.3.2) in OnePlus 6 with TWRP 3.4.0.3.

The idea for things to work smoothly in TWRP is that your main user must not have any lock screen security/credential for the purpose of taking backup in TWRP. This way, TWRP can automatically decrypt main user, work profile user and also the Parallel Apps user.

Follow these steps:

Setup a Screen Lock to PIN/Password/Pattern for your main user/profile, if you don't have it already.

In Settings â†’ Security & lock screen, enable/tick Use one lock for Work Profile. This means that neither Android system, nor your work profile apps would ask for additional credentials to be used.

Set Screen Lock for your main user/profile to None. That is, remove lock screen security.

Now, boot into TWRP. TWRP would automatically decrypt your main user account (user 0), your work profile account, and also the Parallel Apps user (user 999). If you have setup a secondary user account, you can easily decrypt it with the command:

twrp decrypt CREDENTIALS SECONDARY_USER_ID

Alternatively, in TWRP, go to Advanced â†’ Decrypt User â†’ select your secondary user â†’ enter its credentials.

— Firelord | Sources

How to decrypt Island / Work profile and Parallel Apps user in TWRP?

Topics