66802: DeviceLock DLP: Configuration - Shadow Log Contains a File of .dsk Extension

use Google Translate

Applies to: 

Last update: Tue, 2020-11-17 09:54

Description

After formatting a flash drive, Shadow Log Viewer contains a shadow copy of .dsk format.

Comments

Basically, formatting is the process of writing a file system on a removable flash drive. The issue hence indicates that the shadowing functionality of DeviceLock got activated to generate a shadow copy of the file system while the flash drive was being formatted.

Recommendations

Disable shadowing during formatting process by creating a special Content-Aware Rule:

- Create a CAWL group including one file type:

Extension: DSK
Description: Generic PC disk image

- Create a rule with this group for Everyone;
- The rule must be apllied for - SHADOWING, Device Types – REMOVABLE;
- Check ‘DENY WRITE’ flags for ‘Generic’ and ‘Encrypted’ media.

NOTE
Compatible with DL 6.4-6.4.1 versions only.

For DL versions 7.3 and newer you need to explicitly deny shadowing of Format operation for Removable in "Auditing, Shadowing & Alerts".