Step-by-Step: Installing and Configuring EaseFilter File Protector

EaseFilter File Protector: Complete Guide to Features & Setup

Overview

EaseFilter File Protector is a Windows file-system filter solution (built on EaseFilter’s File System Filter Driver SDK) that monitors, controls and can transparently encrypt file I/O at the kernel level. It intercepts file operations (open, read, write, rename, delete, browse, etc.) to enforce access rules, log activity, block unauthorized actions, and integrate encryption/DRM or DLP workflows.

Key features

• Real-time monitoring: Capture file I/O events (create/open/read/write/close/rename/delete) with process, user and timestamp details.
• Access control rules: Allow or deny operations by file path, file mask, process name/ID, user, or session.
• Per-process and per-user rights: Grant different rights (read/write/rename/delete) to specific processes or users.
• Callback-based control: Register pre/post I/O callbacks to inspect, modify or block operations programmatically.
• Transparent on-access encryption: Encrypt/decrypt files on-the-fly with per-file IVs so only authorized principals see plaintext.
• Directory browsing hiding: Hide files/folders from directory listings while keeping them present on disk.
• Reparse/redirect: Reparse file opens to alternate locations for virtualization or sandboxing use cases.
• Auditing & logging: Detailed logs with I/O data, status codes, file times and caller information for SIEM/EDR integration.
• Sample apps & SDKs: C# and C++ sample projects demonstrating protect, monitor, encryption, DRM and process/registry filters.
• Process & registry filtering: Optional modules to block unauthorized executables and protect registry keys.

Common use cases

• Data Loss Prevention (DLP) and preventing unauthorized copy/USB exfiltration.
• Ransomware mitigation by blocking unknown processes from writing or deleting files.
• Transparent DRM/encryption for secure file sharing.
• File access auditing for compliance and forensics.
• Application-level sandboxing and secure folders.

Components you’ll use

• Filter driver service (kernel-mode filter).
• Filter control library (EaseFilter.FilterControl, available as SDK/NuGet).
• Management/console or custom control app using provided APIs.
• Sample FileProtector demo project (C#) used to create rules and callbacks.

Installation and prerequisites (Windows)

1. Windows with administrative privileges.
2. Obtain EaseFilter File Control SDK / FileProtector demo (download from EaseFilter website or NuGet package for the managed library).
3. Visual Studio (for building samples/custom apps) if developing; otherwise use provided installers.
4. Ensure drivers can be installed (driver signing policy — follow EaseFilter documentation for signing/trial keys).

Quick setup — step‑by‑step (practical, minimal working example)

1. Install the FileProtector demo or copy SDK runtime DLLs and driver installer into your target machine.
2. Run installer or register/start the filter service as Administrator (the demo/SDK includes scripts or an executable to StartFilter).
3. Launch the management console or sample FileProtector app.
4. Create a filter rule:
   • Set watch path (supports wildcards), e.g., c:\sensitive*
   • Choose masks (include/exclude patterns), e.g.,.docx, *.xlsx
   • Configure access flags: disable delete, disable rename, block write for unknown processes.
   • Add allowed processes/users (e.g., allow notepad.exe or domain\Alice full access).
5. (Optional) Register callback handlers in your control app to inspect/prevent specific I/O (PRE_CREATE, PRE_READ, PRE_WRITE, PRE_SET_INFORMATION). Example: on PRECREATE, return AccessDenied to block deletions.
6. (Optional) Enable transparent encryption in the rule and configure key management per EaseFilter docs.
7. Test: attempt operations from allowed and blocked processes; verify console logs and system behavior.
8. Deploy rules to target systems and monitor logs centrally (or integrate with SIEM).

csharp
 ffON2NH02oMAcqyoh2UU MQCbz04ET5EljRmK3YpQ CPXAhl7VTkj2dHDyAYAf” data-copycode=“true” role=“button” aria-label=“Copy Code”>Copy CodeCopied
// pseudocode based on EaseFilter sample
FilterControl filter = new FilterControl();
filter.StartFilter(FilterAPI.FilterType.CONTROL_FILTER | FilterAPI.FilterType.ENCRYPTION_FILTER, 5, 10, licenseKey, ref err);
var rule = new FileFilter(“c:\sensitive\*”);
rule.EnableDeleteFile = false;
rule.EnableRenameOrMoveFile = false;
rule.AddProcessRights(“c:\sensitive\*”, “trusted.exe”, ALLOW_MAX_RIGHT_ACCESS);
filter.AddFileFilterRule(rule);