Ecryptfs encrypts filenames and sometimes I need to find particular file, so I would like a tool to map the encrypted filenames back to their plaintext file name.

3 Answers 3


As of ecryptfs-utils version 96, ecryptfs-find is the best way to go from an encrypted path to a non-encrypted path. It meets the needs of most users that need to map between filenames, but there are some things to note about the tool:

  1. It doesn't decrypt filenames. It maps the filenames based on the inode number corresponding to a file.
  2. You must have a live eCryptfs mount. "Offline" mapping of filenames is not possible with ecryptfs-find.
  3. ecryptfs-find may return multiple results and only one of them will be the actual decrypted version of the path you're looking for. If an inode has multiple hard links, paths to each hard link will be printed.
  • regarding #2, then what's the point? If there is already a live mount,why not just run regular 'find' on that?
    – Michael
    Mar 12, 2020 at 17:01

You would want to use the utility ecryptfs-find


ecryptfs-map does this: https://gist.github.com/monperrus/7a114ccc1c2fd20dcc5e852cdf813c5d

it is much faster than ecryptfs-find because it does not iterate over the whole filesystem tree with find.

You must log in to answer this question.