DeviceLock Service : Managing DeviceLock Service for Windows : Service Options : Auditing & Shadowing : Local storage directory
  
Local storage directory
Use this parameter to define where on the local disk cached data (audit/shadowing data, data for content analysis and the alert queue) is stored.
By default, DeviceLock Service uses the %SystemRoot%\SHADOW directory to store cached data (audit/shadowing data, data for content analysis and the alert queue) on the local computer. %SystemRoot% is a standard environment variable that expands to a path to the Windows root folder (for example, C:\Windows). You can specify any other directory on any locally accessible hard disk.
DeviceLock Service protects this directory so regular users cannot access files inside it.
Make sure that there is enough space to store the data (if the user copies 1GB to the flash drive, then you need approximately 2GB available in local storage).