Systems and methods for providing real time security and access monitoring of a removable media device

1. A method comprising:

detecting a removable media device being coupled to an external device port of a digital device, the digital device having an operating system and a file system;

causing, after detecting the removable media device being coupled to the external device port of the digital device, at least a portion of redirection code to be temporarily generated on the digital device by a login module, the redirection code including an interceptor, a data security policy, and a data security process;

intercepting, using the interceptor, a first function call to the operating system or the file system of the digital device before the first function call is executed by the operating system or the file system, the first function call including a request of the operating system or the file system to retrieve data from or write data to the removable media device, the first function call being initiated by a particular user or a particular application;

performing a set of one or more second function calls in response to intercepting the first function call, the set of one or more second function calls not including the first function call, the set of one or more second function calls including a data-security-based second function call, the data-security-based second function call causing the steps of:

executing the data security process, the data security process determining whether the request to retrieve the data from or write the data to the removable media device adheres to the data security policy, and thus whether to allow the first function call based at least on results of the data security process and the data security policy; and

allowing the operating system or the file system to execute the first function call in response to a determination to allow the first function call;

detecting the removable media device is being removed from the external device port of the digital device; and

terminating the at least a portion of the redirection code after detecting the removable media device is being removed from the external port of the digital device.

2. The method of claim 1 , wherein causing the at least a portion of the redirection code to be generated comprises injecting the at least a portion of the redirection code into the digital device by temporarily replacing one or more dynamic-link libraries (DLLs) within the digital device.

3. The method of claim 1 , wherein causing the at least a portion of the redirection code to be generated comprises injecting the at least a portion of the redirection code into the digital device by enumerating user processes of the digital device and injecting DLLs into the enumerated user processes.

4. The method of claim 1 , further comprising receiving a shutdown command and removing the at least a portion of the redirection code in response to the shutdown command.

5. The method of claim 1 , wherein the step of terminating the at least a portion of the redirection code includes removing the at least a portion of the redirection code in response to a detection that the removable media device is no longer coupled to the digital device.

6. The method of claim 1 , wherein the data security process includes a malware detection process.

7. A system comprising:

one or more hardware processors;

memory coupled to the one or more hardware processors and storing computer code, the computer code when executed controlling the one or more hardware processors to:

detect a removable media device being coupled to an external device port of a digital device, the digital device having an operating system and a file system;

cause, after detecting the removable media device being coupled to the external device port of the digital device, at least a portion of redirection code to be temporarily generated on the digital device by a login module, the redirection code including an interceptor, a data security policy, and a data security process;

intercept, using the interceptor, a first function call to the operating system or the file system of the digital device before the first function call is executed by the operating system or the file system, the first function call including a request of the operating system or the file system to retrieve data from or write data to the removable media device, the first function call being initiated by a particular user or a particular application; and

perform a set of one or more second function calls in response to intercepting the first function call, the set of one or more second function calls not including the first function call, the set of one or more second function calls including a data-security-based second function call, the data-security-based second function call causing the steps of:

execute the data security process, the data security process determining whether the request to retrieve the data from or write the data to the removable media device adheres to the data security policy, and thus whether to allow the first function call based at least on results of the data security process and the data security policy; and

allow the operating system or the file system to execute the first function call in response to a determination to allow the first function call;

detect the removable media device is being removed from the external device port of the digital device; and

terminate the at least a portion of the redirection code after detecting the removable media device is being removed from the external port of the digital device.

8. The system of claim 7 , wherein the computer code is further configured to cause the one or more hardware processors to inject the at least a portion of the redirection code into the digital device by temporarily replacing one or more dynamic-link libraries (DLLs) within the digital device.

9. The system of claim 7 , wherein the computer code is further configured to cause the one or more hardware processors to cause the at least a portion of the redirection code to be generated by injecting the at least a portion of the redirection code into the digital device by enumerating user processes of the digital device and injecting DLLs into the enumerated user processes.

10. The system of claim 7 , wherein the computer code is further configured to cause the one or more hardware processors to receive a shutdown command and remove the at least a portion of the redirection code in response to the shutdown command.

11. The system of claim 7 , wherein the computer code is further configured to cause the one or more hardware processors to remove the at least a portion of the redirection code in response to a detection that the removable media device is no longer coupled to the digital device.

12. The system of claim 7 , wherein the data security process includes a malware detection process.

13. A non-transitory computer readable media comprising instructions, the instructions executable by a processor to perform a method, the method comprising:

detecting a removable media device being coupled to an external device port of a digital device, the digital device having an operating system and a file system;

causing, after detecting the removable media device being coupled to the external device port of the digital device, at least a portion of redirection code to be temporarily generated on the digital device by a login module, the redirection code including an interceptor, a data security policy, and a data security process;

intercepting, using the interceptor, a first function call to the operating system or the file system of the digital device before the first function call is executed by the operating system or the file system, the first function call including a request of the operating system or the file system to retrieve data from or write data to the removable media device, the first function call being initiated by a particular user or a particular application;

performing a set of one or more second function calls in response to intercepting the first function call, the set of one or more second function calls not including the first function call, the set of one or more second function calls including a data-security-based second function call, the data-security-based second function call causing the steps of:

executing the data security process, the data security process determining whether the request to retrieve the data from or write the data to the removable media device adheres to the data security policy, and thus whether to allow the first function call based at least on results of the data security process and the data security policy; and

allowing the operating system or the file system to execute the first function call in response to a determination to allow the first function call;

detecting the removable media device is being removed from the external device port of the digital device; and

terminating the at least a portion of the redirection code after detecting the removable media device is being removed from the external port of the digital device.