TrueCrypt container is treated as removable storage

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

When you copy confidential data into a TrueCrypt container using Windows Explorer, the DLP Endpoint agent identifies it as Removable Storage.
When you copy confidential data into a TrueCrypt container using Command Prompt, the DLP Endpoint agent identifies it as Local Drive.

Resolution

The DLP Endpoint agent is working as designed.
DLP Endpoint agent identifies the TrueCrypt container (Virtual Drive) as Removable Storage. Basically this is expected behavior, the Truecrypt Virtual Drive is essentially a file which can be disconnected and move elsewhere such as USB, hence the reason why file-based virtual drives are always treated as removable media.

The TrueCrypt application can mount the encrypted volume in different ways:

http://www.truecrypt.org/docs/favorites#Y604

An enhancement request (PM-2076) has been opened to add the following functionality into the DLP agent:

- If the user will mount the TrueCrypt encrypted volume as Removable Medium, the DLP agent will identify the VHD as Removable Storage.
- If the user will mount the TrueCrypt encrypted volume as Fixed Drive, the DLP agent will identify the VHD as Fixed Drive.