hello therealmatiss,
here’s see-also topic, Disk Encryption on TX2 - #5 by JerryChang.
you may enable Jetson Security, you’ll need to program the fuse to burn the keys.
please also check this tutorial, Jetson Security and Secure Boot. this video gives an overview of security features for the Jetson product family and explains in detailed steps the secure boot process, fusing, and deployment aspects.
let’s start with internal storage, i.e. eMMC.
you may check the default flash configuration file, flash_l4t_t186_enc_rfs.xml for reference,
there’re APP and APP_ENC partitions, which the unencrypted APP partition contains the /boot branch of the root file system, including the kernel, DTB, and initrd images; another encrypted APP_ENC partition contains the rest of the root file system.
thanks