EldoS | Feel safer!

Software components for data protection, secure storage and transfer

Scanning of files from anti-virus software

Also by EldoS: Solid File System
A virtual file system that offers a feature-rich storage for application documents and data with built-in compression and encryption.
#11750
Posted: 11/18/2009 14:03:04
by Ian Colomby (Priority Standard support level)
Joined: 11/14/2008
Posts: 25

We've added a network mounting point to the Mapper sample, and have mapped \\OurShareName\Folder1 to C:\1. We also have McAfee AntiVirus set up to scan files when reading and writing to disk, as well as on network drives.

Upon reading/writing to/from a file named \\OurshareName\Folder1\File1.doc, is the file scanned twice by the antivirus (once on the local disk and once to the UNC path)?


Thanks,
Ian.
#11751
Posted: 11/18/2009 14:17:56
by Eugene Mayevski (EldoS Corp.)

I am not sure that I understand the question. Are you asking how many times it is scanned (once or twice) or you are asking, why it is scanned twice?

In fact, it can be scanned twice because two read requests are sent (and file system filter intercepts requests): first request goes from the reading application to the network redirector, and the second request goes from network redirector to the file system. So depending on how the filter is written, the file can be scanned once or twice.


Sincerely yours
Eugene Mayevski
#11757
Posted: 11/19/2009 09:01:27
by Ian Colomby (Priority Standard support level)
Joined: 11/14/2008
Posts: 25

What are the parameters that would influence the “depending on how the filter is written” and how could we confirm?
#11758
Posted: 11/19/2009 09:43:02
by Eugene Mayevski (EldoS Corp.)

You need to contact the vendor of the antivirus with this question. I think it should be possible to exclude certain disks from checking, and then checking will occur only once -- when the redirector accesses the share.


Sincerely yours
Eugene Mayevski
#11765
Posted: 11/20/2009 12:54:20
by Ian Colomby (Priority Standard support level)
Joined: 11/14/2008
Posts: 25

If I understand correctly if our mounting point is a UNC network mounting point mapped to a folder on the local hard disk. If we copy a file to the UNC path (or save a file via an application) the file can be scanned twice, once when it is being written to the mounting point, and a second time when our implementation of the Callback File System callbacks write the the file to the local hard disk, and the same would hold true for the reverse when a file is read.

Ian.
#11766
Posted: 11/20/2009 13:48:24
by Eugene Mayevski (EldoS Corp.)

Yes, if you map the actual files on the disk to the virtual disk, then scanning can occur twice unless the filter is disabled for one of the drives.


Sincerely yours
Eugene Mayevski
Also by EldoS: CallbackDisk
Create virtual disks backed by memory or custom location, expose disk images as disks and more.

Reply

Statistics

Topic viewed 2613 times

Number of guests: 1, registered members: 0, in total hidden: 0




|

Back to top

As of July 15, 2016 EldoS Corporation will operate as a division of /n software inc. For more information, please read the announcement.

Got it!