Use Case 2: Device-Level GuardPoints

Protect structured or unstructured data stored in data files. The data files are organized inside one or more directories or folders within a file system namespace, such as NTFS or ReFS, without any protection on the folders or the file system namespace. In this use case, the file system resides in the device guarded as Efficient Storage using a policy with a key rule and no user specified access rule. Access rules are not applicable in this use case and should not be used.

File system resides in device guarded as ES GuardPoint

Example

In the following example, the Windows Administrator has created a new 10 MG VHD in the Windows Disk Management tool. This VHD is called Disk 3, and it has not yet been initialized.

The Windows Administrator then uses voradmin esg list disk to get the CTE device name for the new disk and initializes it using the voradmin esg config new command, as shown:

voradmin esg list disk

Disk###  Device Name                        Boot Disk  Size       Status     Partition  Read Only  SERIAL NUMBER
-------  ---------------------------------  ---------  ---------  ---------  ---------  ---------  -------------
Disk0    \Device\Ide\IdeDeviceP0T0L0-0      Yes        127.0 GB   Online     MBR        No
Disk1    \Device\00000032                   No         49.9 GB    Online     MBR        No
Disk2    \Device\00000033                   No         50.9 GB    Online     MBR        No
Disk3    \Device\00000051                   No         10.0 GB    Online     MBR        No
C:\>voradmin esg config new \Device\00000051=NewDisk3
Disk is initialized successfully with CTE ESG protection.

The Administrator guards the new disk through the CipherTrust Manager, and uses the voradmin esg status command to make sure the new disk has been successfully guarded.

voradmin esg status

Disk###  Device Name                        Boot Disk  ESG Device label           Guard Status   Xform Status
-------  ---------------------------------  ---------  -------------------------  -------------  -------------
Disk0    \Device\Ide\IdeDeviceP0T0L0-0      Yes        NA                         unguarded
Disk1    \Device\00000032                   No         esg-disk1-demo             guarded         Completed
Disk2    \Device\00000033                   No         esg-disk2-demo             guarded         Completed
Disk3    \Device\00000051                   No         NewDisk3                   guarded         NA

After the device has been guarded, the Administrator returns to the Windows Disk Manager and selects Action > Rescan Disks to make sure the Windows Disk Manager is synchronized with CTE. They then initialize the disk, create a new volume for it, and format it. Notice that the new volume size is slightly smaller than the original 10 GB because CTE has reserved room for the CTE Private Region.