Comment by tomrod

> Aha! So this mysteriously-named /usr/sbin/eis3920 program is responsible for the decryption. eis3920 is an ARM binary, but running strings on it came up with some items of interest:

    ...
    /sys/devices/platform/omap/omap_i2c.2/i2c-2/2-0057/eeprom
    %s%s%s%s%s
    /home/root
    .ecryptfs
    sig-cache.txt
    ecryptfs_fnek_sig=
    %s%s%s%s%s%s%s%s%s%s%s%s
    mount -t ecryptfs 

I'm at a bit of a loss here. What does he mean by "running strings on it"?