Probably cache directories and temp files for your web browser and other things.
#!/bin/zsh
du -s ~/.*(/) | sort -n
A better way to mirror a directory tree is to use rsync, although it may not work with extended attributes or other exotic features depending on the filesystems involved.
rsync -avn /home/chaz /newdrive/
means "replicate the directory named chaz into the directory /newdrive/
alternately,
rsync -avn /home/chaz/ /newdrive/chaz/
adding a / after chaz means "replicate the
contents of the directory chaz (into the directory /newdrive/chaz/). Adding a / to the first command line would turn /newdrive/ into your new home dir, rather than what you want, which is to make /newdrive/chaz/ your new home dir.
Drop the n to do it for real (-av), and add --progress to show progress bars, and add --delete to delete files at the destination when they don't exist at the source.
I don't see how an encryption system worth using could possibly be decrypted on the fly.
http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation#Counter_.28CTR.29You're probably thinking of the traditional CBC mode that works well only for data streams. And ECB mode which is simply horrid.
I suppose an encrypted filesystem could theoretically use extended attributes to mark files as encrypted or not, and decrypt files one at a time so as not to require enough space to replicate all the files at once, but there are probably policy reasons for not doing that. It would mean users couldn't easily tell which files are and aren't encrypted without using special tools to check extended attributes. Most people probably want to assume that if they mount an encrypted filesystem, all files are encrypted all the time.