5 Replies Latest reply: Feb 19, 2014 3:07 PM by vimalnavis RSS

    Can I Store Evidence of Data Saved to Mobile Devices? (Phones)




      Is there any way I can store evidence for users who save data to their mobile devices?


      I was able to set up a device rule which lets me know when a mobile device is plugged in to and unplugged from the machine. However I don't seem to be able to get it to store evidence if the users saves files to their device.


      I am successfully monitoring and storing evidence when users write data to an external drive like a flash drive. I originally assumed that mobile devices would be treated as storage devices and would fall under my default "Monitor and Store Evidence" Protection Rule but that does not seem to be the case.


      I'm not seeing a way for me to add the PnP Definition to the Protection Rules so that I can store evidence for these devices. Only a Removable Storage Protection rule which doesn't let me select Device Classes.


      Any help would be greatly appreciated. Hopefully I worded this correctly..


      Thank you.


      Edited: Formatting on 7/10/13 2:32:01 PM CDT