Filesystem-level encryption, often called file or folder encryption, is a form of disk encryption where individual files or directories are encrypted by the file system itself, in contrast to full disk encryption where the entire partition or disk, where the file system resides on, is encrypted.
The advantages of filesystem-level encryption include more flexible file-based key management and access control with public-key cryptography and the fact that cryptographic keys are only kept in memory while a file using them is opened.
General-purpose file systems with encryption
Unlike cryptographic file systems and full disk encryption, generic file systems with filesystem-level encryption do not typically encrypt file system metadata, such as the directory structure, file names, sizes or modification timestamps. This can be problematic if the content to be encrypted has to be undetectable or its existence unprovable.
Cryptographic file systems
Cryptographic file systems are file systems that are specifically designed with encryption and security in mind. They usually encrypt all the data they contain – including metadata. Instead of implementing an on-disk format and their own block allocation, these file systems are often layered on top of existing file systems, for example, residing in a directory on a host file system. Many such file systems also offer advanced features, such as deniable encryption, cryptographically secure read-only file system permissions and different views of the directory structure depending on the key or user.
See also
Some File Folder Encryption Software
 | This cryptography-related article is a stub. You can help Wikipedia by expanding it. |