I would like to create an encrypted folder on my ext4-data partition, where I can move some secret data into.

how do I create such a folder?

The drive is already more than half full, so is there a way so I don't have to define the size of the folder when creating it?

Optimally it grows as it gets filled.


Thanks, due to your answers, I will use ecryptfs.

Please show here, how the bash commands would look like to configure this, so in the end I would have the folder /data/ where I could move files into (I would like to encrypt my photo-library folder, which is on another harddrive)

And where and when I would have to enter the password in the boot-process to have this folder available after every reboot.


Your two options are Ecryptfs and EncFS. Both present a FUSE interface, so the data is stored in files on your ext4 filesystem and is accessed through a mount point.

Both have the same security goals: they encrypt file contents and file names but leave directory structure and metadata (e.g. sizes, modification times) visible.

With either of these, you first create the filesystem, which starts out empty. Then you move data into it, which encrypts the data. The disk usage remains roughly the same throughout the move since the cleartext data is erased as the encrypted data is created.

Once you've moved your data, completely fill the cleartext filesystem with a file: cat /dev/zero >zero; rm zero. This will wipe the former content of the erased files. There will still be traces of names and metadata of erased files in directory entries here and there; the only realistic way to get rid of them would be to erase the whole partition.

Ecryptfs is what you get when you select home directory encryption under Ubuntu; you can set it up after installation through the GUI. The Arch Wiki has detailed command line instructions. Ecryptfs comes with tools that automate putting encrypted data in ~/.Private and mounting it on ~/Private: just run ecryptfs-setup-private. In the default Ubuntu setup, your login password becomes the passphrase for your Ecryptfs key file; this may not be desirable if you prefer a short login/screen-unlock password and a long decryption passphrase.

Between Ecryptfs and EncFS, I recommend Ecryptfs because its design looks a lot cleaner, and it has better performance because it hooks into the kernel. The only reason I would choose EncFS is if I'm on a machine whose kernel doesn't support Ecryptfs: it can't be installed without root access, whereas EncFS only requires the permission to use FUSE.

  • is there a similar script like ecryptfs-setup-private, but not for the home-folder but for a definable folder on another partition instead? (I would like to encrypt my photo-library folder, which is on another harddrive) – rubo77 Apr 11 '13 at 15:41

You might want to use encfs. Each file in the encrypted filesystem corresponds to a file in the backing filesystem, but the contents and names are encrypted. Because encfs is not really a filesystem, just an encryption layer on top of a folder in your real filesystem, the encrypted files don't take significantly more space than they would if they weren't encrypted.

This approach has the following disadvantages:

  • An attacker can still see how big the files are and how they are grouped into folders (although he can't see the real names of the files and folders). For example, he might be able to identify that there's a git repository in your encfs with high confidence because git repositories have certain structural characteristics.
  • It uses FUSE – therefore, all data has to do one round-trip between kernel and userspace that's not needed normally, so it's a bit slow.
  • would that slow down as much as that for example raw-data video-files start to stutter? – rubo77 Apr 11 '13 at 9:34
  • @rubo77: No idea. – thejh Apr 11 '13 at 10:33

EncFS does what you look for. Here are some directions for Ubuntu which are probably applicable to many other Linux distributions.

The usual method of encrypted filesystems is to encrypt the partition, regardless of the type of filesystem applied to it (this encrypts not only the files themselves, but all the metadata which define which byte is part of what file or directory). Because of your requirements of "grows as it get filled", this is not easily done in your case. EncFS uses the other method, i.e. a special encryption-aware filesystem which piggybacks on an actual unencrypted filesystem for the dreary job of keeping tracks of bytes on the disk surface. This tends to leak a bit more data, so that an attacker who can spy repeatedly on your disk could probably make some good guesses as to the size and nature of the files you are writing on the encrypted filesystem.

If you want an encrypted filesystem in order to defeat an attacker who steals your unpowered laptop computer, then EncFS will be fine.

  • Why do you recommend EncFS over Ecryptfs? My impression is that Ecryptfs has a cleaner design and is more actively maintained, but I haven't looked into them in detail. – Gilles 'SO- stop being evil' Apr 11 '13 at 10:23
  • From what I read on the Web, eCryptFS is more integrated into the system, with part of it done in the kernel, so it is supposedly faster, but more invasive. I'd say go with eCryptFS if it is natively supported by your distribution; but EncFS will be easier otherwise, especially if you are a non-root user on a shared system. – Thomas Pornin Apr 11 '13 at 11:23

Here is the command you are looking for:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.