Random padding can be detected and the existence of encrypted files would be a giveaway that users use incognito often (which may not be wanted) Iirc on *nix t

Random padding can be detected and the existence of encrypted files would be a giveaway that users use incognito often (which may not be wanted) Iirc on *nix there’s a difference between inodes and vnodes that you might be able to take advantage of as well. The supervisor would create, open, and delete the directory before filling it. Holding the directory open gives it a vnode count of one and deleting it gives an inode count of zero thus making the current process the last thing to ever be able to reach the directory. You’d have to make sense of a full disk binary scan to guess what used to there if the disk wasn’t zeroed out, so encryption could help there too.