diff --git a/cmds/installd/commands.cpp b/cmds/installd/commands.cpp
index 90ef277..0713241 100644
--- a/cmds/installd/commands.cpp
+++ b/cmds/installd/commands.cpp
@@ -452,16 +452,11 @@
  * also require that apps constantly modify file metadata even
  * when just reading from the cache, which is pretty awful.
  */
-int free_cache(const char *uuid, int64_t free_size)
-{
+int free_cache(const char *uuid, int64_t free_size) {
     cache_t* cache;
     int64_t avail;
-    DIR *d;
-    struct dirent *de;
-    char tmpdir[PATH_MAX];
-    char *dirpos;
 
-    std::string data_path(create_data_path(uuid));
+    auto data_path = create_data_path(uuid);
 
     avail = data_disk_free(data_path);
     if (avail < 0) return -1;
@@ -471,65 +466,12 @@
 
     cache = start_cache_collection();
 
-    // Special case for owner on internal storage
-    if (uuid == nullptr) {
-        std::string _tmpdir(create_data_user_ce_path(nullptr, 0));
-        add_cache_files(cache, _tmpdir.c_str(), "cache");
-    }
-
-    // Search for other users and add any cache files from them.
-    std::string _tmpdir(create_data_path(uuid) + "/" + SECONDARY_USER_PREFIX);
-    strcpy(tmpdir, _tmpdir.c_str());
-
-    dirpos = tmpdir + strlen(tmpdir);
-    d = opendir(tmpdir);
-    if (d != NULL) {
-        while ((de = readdir(d))) {
-            if (de->d_type == DT_DIR) {
-                const char *name = de->d_name;
-                    /* always skip "." and ".." */
-                if (name[0] == '.') {
-                    if (name[1] == 0) continue;
-                    if ((name[1] == '.') && (name[2] == 0)) continue;
-                }
-                if ((strlen(name)+(dirpos-tmpdir)) < (sizeof(tmpdir)-1)) {
-                    strcpy(dirpos, name);
-                    //ALOGI("adding cache files from %s\n", tmpdir);
-                    add_cache_files(cache, tmpdir, "cache");
-                } else {
-                    ALOGW("Path exceeds limit: %s%s", tmpdir, name);
-                }
-            }
-        }
-        closedir(d);
-    }
-
-    // Collect cache files on external storage for all users (if it is mounted as part
-    // of the internal storage).
-    strcpy(tmpdir, android_media_dir.path);
-    dirpos = tmpdir + strlen(tmpdir);
-    d = opendir(tmpdir);
-    if (d != NULL) {
-        while ((de = readdir(d))) {
-            if (de->d_type == DT_DIR) {
-                const char *name = de->d_name;
-                    /* skip any dir that doesn't start with a number, so not a user */
-                if (name[0] < '0' || name[0] > '9') {
-                    continue;
-                }
-                if ((strlen(name)+(dirpos-tmpdir)) < (sizeof(tmpdir)-1)) {
-                    strcpy(dirpos, name);
-                    if (lookup_media_dir(tmpdir, "Android") == 0
-                            && lookup_media_dir(tmpdir, "data") == 0) {
-                        //ALOGI("adding cache files from %s\n", tmpdir);
-                        add_cache_files(cache, tmpdir, "cache");
-                    }
-                } else {
-                    ALOGW("Path exceeds limit: %s%s", tmpdir, name);
-                }
-            }
-        }
-        closedir(d);
+    auto users = get_known_users(uuid);
+    for (auto user : users) {
+        add_cache_files(cache, create_data_user_ce_path(uuid, user));
+        add_cache_files(cache, create_data_user_de_path(uuid, user));
+        add_cache_files(cache,
+                StringPrintf("%s/Android/data", create_data_media_path(uuid, user).c_str()));
     }
 
     clear_cache_files(data_path, cache, free_size);
diff --git a/cmds/installd/utils.cpp b/cmds/installd/utils.cpp
index 90d2a9e..c838993 100644
--- a/cmds/installd/utils.cpp
+++ b/cmds/installd/utils.cpp
@@ -521,56 +521,6 @@
     return res;
 }
 
-int lookup_media_dir(char basepath[PATH_MAX], const char *dir)
-{
-    DIR *d;
-    struct dirent *de;
-    struct stat s;
-    char* dirpos = basepath + strlen(basepath);
-
-    if ((*(dirpos-1)) != '/') {
-        *dirpos = '/';
-        dirpos++;
-    }
-
-    CACHE_NOISY(ALOGI("Looking up %s in %s\n", dir, basepath));
-    // Verify the path won't extend beyond our buffer, to avoid
-    // repeated checking later.
-    if ((dirpos-basepath+strlen(dir)) >= (PATH_MAX-1)) {
-        ALOGW("Path exceeds limit: %s%s", basepath, dir);
-        return -1;
-    }
-
-    // First, can we find this directory with the case that is given?
-    strcpy(dirpos, dir);
-    if (stat(basepath, &s) >= 0) {
-        CACHE_NOISY(ALOGI("Found direct: %s\n", basepath));
-        return 0;
-    }
-
-    // Not found with that case...  search through all entries to find
-    // one that matches regardless of case.
-    *dirpos = 0;
-
-    d = opendir(basepath);
-    if (d == NULL) {
-        return -1;
-    }
-
-    while ((de = readdir(d))) {
-        if (strcasecmp(de->d_name, dir) == 0) {
-            strcpy(dirpos, de->d_name);
-            closedir(d);
-            CACHE_NOISY(ALOGI("Found search: %s\n", basepath));
-            return 0;
-        }
-    }
-
-    ALOGW("Couldn't find %s in %s", dir, basepath);
-    closedir(d);
-    return -1;
-}
-
 int64_t data_disk_free(const std::string& data_path)
 {
     struct statfs sfs;
@@ -829,13 +779,13 @@
     return 0;
 }
 
-void add_cache_files(cache_t* cache, const char *basepath, const char *cachedir)
-{
+void add_cache_files(cache_t* cache, const std::string& data_path) {
     DIR *d;
     struct dirent *de;
     char dirname[PATH_MAX];
 
-    CACHE_NOISY(ALOGI("add_cache_files: base=%s cachedir=%s\n", basepath, cachedir));
+    const char* basepath = data_path.c_str();
+    CACHE_NOISY(ALOGI("add_cache_files: basepath=%s\n", basepath));
 
     d = opendir(basepath);
     if (d == NULL) {
@@ -861,12 +811,11 @@
                 pathpos++;
                 *pathpos = 0;
             }
-            if (cachedir != NULL) {
-                snprintf(pathpos, sizeof(dirname)-(pathpos-dirname), "%s/%s", name, cachedir);
-            } else {
-                snprintf(pathpos, sizeof(dirname)-(pathpos-dirname), "%s", name);
-            }
+
+            // TODO: also try searching using xattr when CE is locked
+            snprintf(pathpos, sizeof(dirname)-(pathpos-dirname), "%s/cache", name);
             CACHE_NOISY(ALOGI("Adding cache files from dir: %s\n", dirname));
+
             subdir = opendir(dirname);
             if (subdir != NULL) {
                 size_t dirnameLen = strlen(dirname);
diff --git a/cmds/installd/utils.h b/cmds/installd/utils.h
index 477baea..60df356 100644
--- a/cmds/installd/utils.h
+++ b/cmds/installd/utils.h
@@ -114,13 +114,11 @@
 
 int copy_dir_files(const char *srcname, const char *dstname, uid_t owner, gid_t group);
 
-int lookup_media_dir(char basepath[PATH_MAX], const char *dir);
-
 int64_t data_disk_free(const std::string& data_path);
 
 cache_t* start_cache_collection();
 
-void add_cache_files(cache_t* cache, const char *basepath, const char *cachedir);
+void add_cache_files(cache_t* cache, const std::string& data_path);
 
 void clear_cache_files(const std::string& data_path, cache_t* cache, int64_t free_size);