DLP - Fcag.exe unwanted read actions

[User_548887]

Dear All,

We are using ePO 5.10 upd 15 on -prem and DLP endpoint 11.6.600.x. DLP endpoint is used exclusively used for the below purposes

a) Block write access to some types of removable media

b) Log allowed writes to removable media 

We are observing the following behavior: We are currently testing with large files (1.5 GB, 5 GB, 25 GB). When data is written to a removable drive, the file copy completes as expected. However, once the copy action is complete, fcag.exe starts reading the data that was written on the medium. It seems that the read takes about as long as the write action. Hence, we are speculating that the entire data set is being read. For some users this is problematic as they sometimes need to copy large amounts of data to removable media within tight deadlines. Once fcag.exe initiates its reads, write speed drops dramatically.

We are trying to determine which module is responsible for this behavior. When we determine which one it is we can decide, whether we require it or not.

Any pointer would be highly appreciated! 

[User_548887]

Anyone have an idea in this matter?

Thanks