Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to efficiently back up an encrypted copy of my hard drive. I am currently using rsync to backup an unencrypted copy, and I find it quite efficient.

I looked at duplicity and rsyncrypto, but duplicity makes incremental backups, and rsyncrypto uses a unique key for each encrypted file. Duplicity also ran out of memory, and I would need to backup the rsyncrypto keys somewhere. I find these to be space-inefficient, so I don't want to use them.

What I think would work well is if I could loopback/bind mount / and backup the encrypted mountpoint. I looked at eCryptfs and EncFS, but they both seem to only mount encrypted directories, and not allow encrypting a mounted directory. They both support encrypting the filename, which is also a desirable feature.

If I could have an encrypted version of my file system, then my existing rsync-backup would work efficiently. When very little has changed, only the file names need to be encrypted.

Is there a way to encrypt a mounted directory as another directory? Any other suggestions?

share|improve this question
up vote 4 down vote accepted

ugh, i spent way too much time looking for an answer before posting this question, and now i find the --reverse option to encfs does what i want. here's my backup script:

set -e
set -u
CP="/usr/bin/sudo /usr/bin/rsync -aAhHPxX --delete-excluded --del --ignore-errors --rsync-path=\"rsync --fake-super\" $*"

mkdir -p $MOUNTPOINT
mount -t fuse.encfs | grep "^encfs on $MOUNTPOINT type fuse.encfs" || /usr/bin/sudo /usr/bin/encfs --reverse $SOURCE $MOUNTPOINT

#don't cross mount points
EXCLUDE_LIST=$(encfsctl encode $SOURCE `/usr/bin/cut -d\  -f 2 /proc/mounts | /bin/grep -v ^$SOURCE$`)

/usr/bin/rsync -haxHAXPR $SOURCE/.encfs* $DEST/../
#eval for the quotes in the CP command

and to recover a file:

CP='/usr/bin/sudo /usr/bin/rsync -haxHAXPR --no-implied-dirs --rsync-path="rsync --fake-super"';
ENCRYPTED_NAME=$(encfsctl encode $SOURCE $*);
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.