External hard drive

Hello BaySt_Inc,

does the drive "look like" a removable disk in explorer? The endpoint components are port agnostic and AFAIK rely on how the device presents itself to Windows. 

Christian

No, it looks the same as the internal HDD. 

Thanks

Hello BaySt_Inc,

well, if it really mimics an internal disk then DLP won't kick in. You could check with Device Control if it looks internal from the start or briefly appears as removable.

Christian

That's the weird thing.  We have device control policy active to detect but do not block.  Essentially everything is open but logging all activity.  Under the device control events, the harddrive shows up as "removable storage" 

If you have not already done so, please contact Sophos Support. (ideally ask them to notify me so that I can follow up)

We will need to know the exact make, model and specification of the drive?

Also what sort of connection is being used?

- external SATA can look very similar to USB. If an organisation gives users hardware that exposes the internal disk system to them then there is not much we can do :smileysad:

What operating system is involved?

And is it particular hardware platform being connected to?

John Bryan - Virus Lab, Sophos

Hi John,

Yes, we've already contacted Sophos support to no avail.

The plan is to get any drive to log properly, not jsut one specific model.

Connection is strictly USB

Operating systems are a mix of XP and Win7

Don't really understand the last question, sorry.  (Just desktops)

Thanks.