Either the whole disk or the user partition, such that when the device gets stolen no useful information can be extracted from it. I don't have a script; I used berryboot to encrypt the SD card in the past. I'm not a good coder but I'll try to make something work