Encrypting a partition of a removable flash drive with TrueCrypt volume results in creating a shadow copy of a TrueCrypt disk image with ".tc" extension.
Creating an encrypted partition is a process of writing file system on the removable drive, and thus activates shadowing mechanism.
It is not possible to deny shadowing of *.tc files using content-aware rules. There is only one way to avoid shadowing of TrueCrypt partitions:
- Create a CAWL rule for users/groups (or Everyone), which would include only those file types you want to be shadowed;
- This rule must be Apllied for - SHADOWING, Device Types - REMOVABLE, check ALLOW WRITE flags for Generic and Encrypted media.
With this rule active, every file type listed in it, will be a subject to shadowing, copying of other file types (including TrueCrypt images) will not activate shadowing.