How Do I Reduce the size of the NeuShield Overlay?

Posted by by

NeuShield uses local disk space to provide fast, real-time protection against ransomware and other malicious file changes. This article explains what data NeuShield stores, why local storage is required, and how you can reduce disk usage on user systems.

Why NeuShield Uses Local Disk Space

NeuShield relies on a local overlay to capture and protect file changes in real time. Storing this data locally is critical for performance and reliability. File changes are written to the overlay first and then committed to disk on a scheduled basis (24 hours by default).

Because file changes are only held temporarily before being committed, using a cloud-only or remote storage approach would introduce latency and reliability issues and is not practical for this protection model.

What Happens When Disk Space Runs Out?

If a user’s system runs out of free disk space, protected files can no longer be modified.

Here’s why this matters for security:

  1. All file modifications must occur on the NeuShield overlay.
  2. If there is no available space on the overlay, no further changes can be written.
  3. As a result, ransomware or other attacks cannot continue encrypting files once the available free space is exhausted.

For example, if a system has 10 GB of free space and an attacker attempts to encrypt 30 GB of data, only the first 10 GB could be affected. Once the space is consumed, file modifications stop.

Types of Data Stored on the NeuShield Overlay

NeuShield stores three categories of data on the overlay. Understanding these helps identify where disk space is being used and what can be safely adjusted.

  1. Scratch (Temporary) Data
    1. Stores active changes to protected files.
    2. Data remains only until the next commit cycle (24 hours by default).
    3. This data is required for protection and is automatically cleared.
    4. Typically does not cause long-term disk space issues.
  2. Data Engrams (Revision History)
    1. Stores historical versions of files.
    2. Each commit saves a copy of the file before changes are applied.
    3. By default, NeuShield keeps up to 7 engrams per protected file.
    4. This is the only type of data stored permanently on the overlay.
    5. Retention settings are configurable and can be reduced or disabled.
  3. Deleted Protected Files
    1. Stores copies of protected files that are deleted.
    2. Files are retained for 30 days.
    3. Data is automatically removed after the retention period.

How to Reduce Disk Space Usage

Typically, manual clean up of disk space is not needed. NeuShield automatically manages temporary and deleted data. To reduce disk usage further, consider adjusting Data Engram settings.

Recommended Options

  1. Reduce the number of stored Data Engrams per file to 1 or 2.
  2. Limit Data Engrams to smaller files (for example, files under 64 MB).
  3. Disable Data Engrams entirely (not generally recommended as a permanent setting but can be done temporarily to clean up disk space).

Note: If Data Engrams are disabled, the overlay continues to function as normal but if corrupt or damaged data is committed to disk there is no way to reverse it.

Summary

  1. NeuShield requires local disk space for performance and security.
  2. Disk exhaustion prevents further file modifications, limiting ransomware impact.
  3. Temporary and deleted data are automatically cleaned up.
  4. Data Engrams are the primary driver of long-term disk usage and can be customized to meet storage requirements.

Adjusting Data Engram settings allows organizations to balance disk usage with recovery and revision history needs.