Ecryptfs stores each encrypted file in one file (the lower file, in ecryptfs terminology). The directory structure of the lower files mirrors that of the payload files, although the file names are encrypted. The metadata (modification times, in particular) of the lower files also reveals that of the payload files. The size of the lower file is slightly larger than the size of the payload (with a fixed overhead for Ecryptfs's metadata)¹.
If you're storing your own work, where the attacker would already know roughly what kinds of data you have (“I already know this is a source code tree, and I know these are spreadsheets, what I want to know is !”), none of that is a problem. But if you're storing directory trees that may be identified by their layout (directory structure, approximate sizes, dates), then Ecryptfs is not the right tool for you.
Use encryption at the block device level. Linux provides this with dm-crypt. You can encrypt either the whole disk (except for a small area for the bootloader), or encrypt
/home or some other partition. If you don't encrypt the whole disk, keep in mind that confidential information might end up in other places, especially the swap space (if you have any encrypted data anywhere, you should encrypt your swap). Note that if you go for whole-disk encryption, your computer will not be able to boot unattended, you will have to type your passphrase at the keyboard.
Since the whole block device is encrypted, the location of file content and metadata cannot be detected by an attacker who steals the disk. Apart from a header at the beginning of the encrypted area, the content is indistinguishable from random noise. An attacker could derive some information from seeing multiple snapshots of the encrypted data and studying how various sectors evolve over time, but even with this it would be hard to find out anything interesting, and this doesn't apply if you stop modifying the data after the attacker has seen the ciphertext (as in the case of a disk theft).
Many distributions offer the possibility to create a dmcrypt volume or encrypt the whole disk at install time. You may have to select the “advanced” or “server” installation image as opposed to the “desktop” or “basic” image.
The tool to manipulate dm-crypt volumes is
cryptsetup. To create a dmcrypt volume, create a partition
/dev/sdz9, say, then run
cryptsetup luksFormat /dev/sdz9. You'll need to add the volume to
cryptsetup luksOpen to activate the volume on the spot, or
cryptmount -a after you've set up
/etc/crypttab. Dm-crypt is only a cipher layer, so you'll need to make a filesystem on the encrypted volume.
Install Backtrack 5 r2 into running LUKS setup installed with ubuntu has a tutorial on setting up dm-crypt entirely manually.
¹ Experimentally, with default settings, the lower file size is the payload file size, rounded up to a multiple of 4kB, plus an 8kB overhead.