As I wasn't able to flash the system.img, I had another look for a TWRP with decryption enabled. I found a new version (TWRP 3.2.1) and flashed it. After booting into recovery, I was asked for my lock pattern and after entering it, TWRP was able to decrypt my data. With the TWRP file manager I can access /data and modify files there. I was very happy about that and rebooted to download and apply the OTA.
Unfortunaltely, the pattern check at the beginning of the booting process repoorts now that the pattern I've entered is wrong and it decreases a tries counter.
No I have an even bigger problem, because I can't use my phone. I know I enter the correct pattern because I had it for a long time and TWRP is accepting it and is able to decrypt /data.
Is there a way to fix that?
I already renamed gatekeeper.pattern.key, gatekeeper.password.key, locksettings.db, locksettings.db-shm and locksettings.db-wal in order to remove the encryption, but it didn't work. It only reset the retry counter.