In this lesson, you will learn how to assess the exposure risk of plaintext metadata on encrypted storage volumes.
When we encrypt a block device—such as using dm-crypt—we protect the data blocks (the actual contents of your files). However, the filesystem itself (like ext4 or XFS) sits on top of this encrypted layer. The filesystem needs to manage its own metadata to function: things like filenames, directory structures, timestamps, and file sizes.
If you use standard encryption, the metadata remains unencrypted because the filesystem needs to read it to organize your files. This creates an "exposure risk" where an attacker with physical access to your disk can infer a significant amount of information about your activity without ever needing your decryption key.
Identifying Metadata Exposure
Even with the volume encrypted, an observer can analyze the layout of the filesystem to perform traffic analysis or usage pattern tracking. For example, they can see:
- Directory Tree: The hierarchy of your folders.
- File Size/Counts: You might hide the content of a document, but the size of the file on disk remains visible.
- Temporal patterns: By checking timestamps, an attacker can see when files were last modified or accessed.
You can check if a filesystem is utilizing built-in encryption features (like fscrypt) versus volume-level encryption by inspecting the mount options:
mount | grep -E 'ext4|f2fs'
# Look for options like 'test_dummy_encryption' or 'inlinecrypt'
Assessing the Risk
To analyze your specific exposure, consider what you are trying to hide. If your threat model includes an adversary who wants to know what you are doing (e.g., "Are they installing a specific compiler?" or "How many documents are in that folder?"), volume-level encryption alone is insufficient.
If metadata privacy is critical, you must move toward filesystems that support metadata encryption (such as fscrypt on ext4/f2fs), where the encryption key is applied at the inode level, rendering filenames and directory metadata unreadable even to someone who can inspect the raw structure of the filesystem.
Key Takeaway: Standard volume-level encryption protects your data, but leaves your directory structure, filenames, and file sizes exposed as plaintext metadata—requiring filesystem-level encryption features if you need to hide your storage usage patterns.