'''Filesystem-level encryption''', often called file or folder encryption, is a form of [[disk encryption]] where individual files or directories are [[encryption|encrypted]] by the [[file system]] itself, in contrast to [[full disk encryption]] where the entire partition or disk, where the file system resides on, is encrypted.
The advantages of filesystem-level encryption include more flexible file-based [[key management]] and [[access control]] with [[public-key cryptography]] and the fact that [[key (cryptography)|cryptographic keys]] are only kept in memory while a file using them is opened.
==General-purpose filesystemsfile systems with encryption==
Unlike cryptographic filesystemsfile systems and full disk encryption, generic filesystemsfile systems with filesystem-level encryption do not typically encrypt filesystemfile system [[metadata]], such as the directory structure, file names, sizes or modification timestamps. This can be problematic if the content to be encrypted has to be undetectable or its existence unprovable.
Notable filesystemsfile systems that support this kind of encryption include the [[Encrypting File System]] layer of [[NTFS]].
==Cryptographic filesystemsfile systems==
Cryptographic filesystemsfile systems are filesystemsfile systems that are specifically designed with encryption and security in mind. They usually encrypt all the data they contain – including metadata. Instead of implementing an on-disk format and their own [[block allocation]], these filesystemsfile systems are often layered on top of existing filesystemsfile systems, for example, residing in a directory on a host filesystemfile system. Many such filesystemsfile systems also offer advanced features, such as [[deniable encryption]], cryptographically secure read-only [[file system permissions]] and different views of the directory structure depending on the key or user.
