TWRP, though the decryption would probably have to occur prior to restoring the image (i.e. outside of twrp)