US Patent 9058485 Data loss prevention (DLP) through removeable media

Method and apparatuses for detecting violations of data loss prevention (DLP) in NTFS removable media and non-NTFS removable media are described. In NTFS, when an application opens a data file, a DLP file system filter driver internally opens the same data file using file system transaction and is transparent to the application. Application read/writes are redirected to the remote transaction. When the application tries to close the file, the DLP agent scans the data being written to the file for detection of violations and commits or aborts the remote transaction depending upon the detection of a violation of the policy.