[astrange]

> Encrypted filesystems typically encrypt contents of each file separately - that way you don't need to read / write the whole disk to read it write any individual file contents.

Ah, that's not true of "full disk encryption". It usually encrypts the disk blocks.

File-based encryption is stronger; you can use different protection classes on different files, you can use authenticated encryption, etc. iOS does it this way and I assume other systems have caught up, but don't know any in particular.

[tliltocatl]

File-based encryption leaks metadata (which in some cases is bad enough to render it unusable).

[astrange]

No one said you had to leave the FS itself unencrypted.