If you don't agree ... stop reading and move on...
Background: Our phone has access to so much personal information that its scary if it fell into wrong hands. The only way to fix this is to encrypt phone. I did lot of research and here is a working solution that works for me - try at your risk.
a) Tested with ROM Stock 4.4.4 NH7 Galaxy S4 M919/Jfltetmo by @ShinySide
b) Tested with ROM |ROM|★KANGAKAT★|►KTU84P◄|4.4.4|Xposed|►8◄|6.26.14 by @iB4STiD
c) stock recovery AT&T S4 works with M919
d) Philz/CWM custom recovery
Encrypting with custom rom
1) Assume you are on custom recovery. - Backup everything first. Create a nandroid backup
2) Do a full wipe and install one of the two roms linked above (I have tested with few other roms ... none worked). Start the phone and set it up the way you want. Install all apps etc.
3) ODIN Stock recovery. See #c under download above. Its AT&T stock recovery but works for me. You need to know how to ODIN - find out. Doing this wrong will permanently damage your phone
4) Start your phone and turn on encryption. You will need to set lock type = password and will need to connect to charger and have 80% charge.
- Phone will do blank and stay blank for 20-30 minutes. Do not do anything. Encryption is happening behind the scenes.
- You might have to do this twice or thrice if it did not encrypt first time. For me the phone went blank first time and after 25 minutes it restarted but device was not encrypted. I redid the same steps and worked second time.
- If you interrupt the encryption process (battery pull or power up) you will see error message (encryption failed, reset device)
5) If all goes well you now have a password protected encrypted phone with custom rom!!! Check in Settings -> Security
6) You may install custom recovery ... but I don't see the point because you will need stock recovery to decrypt
To install another ROM
1) Reboot into stock recovery, then wipe data and cache (this removes encryption).
2) install your recovery of choice and install ROM using recovery. Philz/CWM
Credit goes to @Tronicus and his reply Flash a Rom on an Encrypted Android
How to Flash a rom on an encrypted Android phone (specifically this one, the I9505 SGH-I337).
The Problem: Once encrypted, you can't decrypt it easily. When encrypting the phone android will tell you you can only decrypt it using a factory reset. Naturally you assume it's talking about the "Factory Data Reset" option found in Settings --> Backup and Reset. But noooo, Android is lying through its ****ing teeth. Then you'll assume you have to wipe everything from your custom recovery mod (CWM, TWRP, or one of those). Wrong again! You'll get beautiful "can't mount /data" messages and more bull****. I read about a workaround that required installing the new rom using ADB, but I had ingeniously disabled USB debugging prior to wiping everything, so I only got so far with that option (plus it's tediously long if you haven't installed all the necessary software already and don't feel like bricking your phone because you made a typo in the command line). So, apparently the only other way to really format that partition free of its encryption is to use a stock recovery. So:
Short Version for Godlike users who know automatically how to do all this **** without any help (mimicking how most help posts are finely detailed on this site): Flash stock recovery, wipe everything, flash your custom recovery and install your new rom.
Long version for us mortals who don't know everything and haven't already downloaded already every single bit of software on earth:
- Backup all the stuff you want to save. This process will truly wipe EVERYTHING. You can do it manually, or you can use an app like Titanium Backup Pro to help you (find it on Google Play Store). Here's a nice guide which recommends what to restore and what not to restore: http://forum.xda-developers.com/show....php?t=1480343
- Flash the stock recovery using Odin. You can download a stock recovery from here: http://forum.xda-developers.com/show...91&postcount=3 It's the link called "I337MK2stockrecovery.tar.md5" In case you don't know how to flash it with Odin, this short guide will help: http://forum.xda-developers.com/show....php?t=1506697
- In step 6 replace "recovery.tar.md5" with the stock recovery you downloaded.
- Wipe everything from the Stock recovery console. This little ****er will **** up the encryption all those sissies couldn't touch. You're welcome. You boot into recovery mode from a turned off phone by pressing simultaneously the volume up key + the home key + the power key until you see blue text appearing in the top left corner of your screen.
- Reinstall your custom recovery. In my case I had installed the rom BEFORE flashing in the stock recovery (apparently it works, you just can't boot because of the encryption), so I was able to boot into the new rom before I returned to my custom recovery. Weird. Anyways, I recommend CWM. You can pick it up from this link: http://goo.im/devs/philz_touch/CWM_A..._Edition/jflte
- For some weird reason they call the I337 version the "jflte" version. It's bonkers. Click there, and download the latest version that ends with .tar.md5. This version is upgradable via Odin, which we already used. Use the same instructions used as when you upgraded the stock recovery rom.
- Boot into your recovery mod and flash your rom like you usually do.