One can see the embedded filename of an encrypted file using gpg --list-packets 001.gpg, which shows:
[...] :literal data packet: mode b (62), created 1630584912, name="elephant.jpg", raw data: 87417 bytes [...] Is there a way to get the embedded filename only? Is there a command that displays elephant.jpg only?
To get the data between name=" and ", on the line after the line saying :literal data packet:, using sed:
gpg --list-packets file.gpg | sed -e '/^:literal data packet:$/!d' \ -e 'N' \ -e 's/[^=]*name="//' \ -e 's/",$//' \ -e 'q' The sed expressions first deletes all lines read from gpg until it finds the :literal data packet: line. It then immediately appends the next line with N and removes everything now in the buffer up to and including the first name=" substring. It then removes ", from the end of the line and quits (outputting what's remaining in the buffer).
This allows us to handle filenames like file", or name="hello" embedded in the gpg data.
Note that special characters will be encoded as a hexadecimal escape sequence before they are embedded in the gpg file. For example, every newline character will be encoded as \x0a.
You could sed the pattern to extract the filename:
$ text=' [...] :literal data packet: mode b (62), created 1630584912, name="elephant.jpg", raw data: 87417 bytes [...] ' $ echo "$text" | sed -n 's/.*name="\(.*\)",/\1/p' elephant.jpg $ 
grep -Po '(?<=name=").*(?=",$)'. One way would be, I imagine, to use the gpg library and do the same thing that the CLI utility does.
Otherwise you could filter gpg output:
#!/bin/bash if [ -z "$1" ]; then echo "No filename specified" 1>&2 exit 1 fi if [ ! -r "$1" ]; then echo "File not found" 1>&2 exit 2 fi gpg --list-packets "$1" \ | grep ", name=" | cut -f2 -d '"' (This assumes that the embedded name does not contain double quotes).
A short version:
gpg --list-packets file.gpg | awk -F\" '/created/ {print $2}' 