This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

File Count when scanning Windows Partitions

Hi all,

I have a custom live boot linux image with Sophos AV installed on it that I use to scan PCs running Windows. I've noticed that the total number of files scanned is less than the number of files apparently on the C: drive, implying that some directories are being skipped and potential gremlins could hide in there. Ideally I'd like Sophos to scan all of the files found in all of the directories on the mounted drive. The command I use is 'savscan /media/ -all –f –dn –archive'. Seems to work fine on other drives, it's just the C: drive that it's having trouble with. Running 'tree -a | tail -1' in a sudo terminal returns a count higher than right click > Properties on Windows which is odd but at least not the other way around.

Many thanks!

This thread was automatically locked due to age.

0 SAJ over 4 years ago

Hello PJLepps.

Can you please do some investigation to identify which type of files were excluded from scanning. Are they executable files?

Please see the below Linux configuration guide and refer the pages 6-9 to see how on-demand scanning is configured.

SAJ

Community Support Engineer | Sophos Technical Support
Knowledge Base | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 PJLepps over 4 years ago in reply to SAJ

Hi SAJ,

Thanks for the reply. As far as I know (unless something in the command is doing it) nothing is being excluded from the scan. At least I hope nothing is. I'll have a read through the link sent over.

thanks again.
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 4 years ago

Hello PJLepps,

right click > Properties on Windows
numbers can lie. And a file is not always a file. Compared the file counts displayed by different tools on a Windows machine: dir, GnuWin's tree, and Explorer's Properties. Small differences are expected as this was on a live system. Didn't check what savscan's count would be.

what difference did you see?

Christian
Cancel
Vote Up 0 Vote Down

Cancel