hiVstanely, you can find the applicatiom/serviices used by particular device to transfer data and need well configure DCM detcetion policy with block responce rule.
Removable media monitoring
Endpoint Prevent lets you block data transferring from your hard drive to a
removable media device. Removable media includes the following devices:
■ USB flash drive
■ SD card
■ Compact flash card
■ FireWire connected device
When the Symantec DLP Agent detects that a violation has occurred, the data is
not transferred. An incident is created and sent to the Endpoint Server. When a
violation occurs, the Symantec DLP Agent displays a pop-up notification to the
user that informs the user that the violation has occurred.