System and method for accessing data from a data storage medium
Systems and methods for managing multiple related pestware processes on a protected computer are described. One embodiment is configured to identify a location of each of a plurality of files in at least one file storage device of the protected computer and store a list of the location of each of the plurality of files. The list of the plurality of files is then sorted so as to generate a sorted list. Each of the plurality of files is then sequentially accessed as listed in the sorted list so as to retrieve information from each of the plurality of files. Information from the plurality of files is then analyzed to determine whether any of the plurality of files are potential pestware files. In variations, the files in the file storage device are enumerated, and information from the files is accessed, by circumventing the operating system of the protected computer.
1. A method for scanning files on a protected computer for pestware comprising:
identifying a location of each of at least a first file, a second file and a third file in at least one file storage device of the protected computer;
retrieving information from the first file;
analyzing the information from the first file to determine whether the first file is a potential pestware file;
accessing, after retrieving the information from the first file, the second file before accessing the third file in response to the time required to access the second file being less than the time required to access the third file;
retrieving information from the second file;
analyzing the information from the second file to determine whether the second file is a potential pestware file; and
reporting results of the analyzing the information from the first and second files to a user.
2. The method of claim 1 further comprising:
sorting, by location, the first file, the second file and the third file so as to generate a sorted list of files.
3. The method of claim 2 wherein the at least one file storage device is a disk drive, and wherein the sorting, by location, is sorting by the cluster numbers of the first file, the second file and the third file.
4. The method of claim 3 wherein the accessing the second file before accessing the third file is in response the second file having a cluster number that is closer to the first file than the third file.
5. The method of claim 1 wherein the identifying includes utilizing an operating system of the protected computer to identify the location of each of at least the first file, the second file and the third file.
6. The method of claim 1 wherein the identifying includes circumventing the operating system of the protected computer while identifying the location of each of at least the first file, the second file and the third file.
7. A system for managing pestware comprising:
at least one processor:
a memory containing a plurality of program instructions, the plurality of program instructions including:
a pestware detection module configured to cause the at least one processor to detect pestware on a protected computer, the protected computer including at least one file storage device; and
a sweep speedup module configured to cause the at least one processor to:
identify a location of each of a first file, a second file, and a third file in the at least one file storage device of the protected computer; and
retrieve information from each of the first file, the second file, and the third file in an order determined by the respective locations of the first file, the second file, and the third file in the file storage device;
wherein the pestware detection module is configured to cause the at least one processor to analyze the retrieved information from each of the first file, the second file, and the third file so as to determine whether each of the first file, the second file, and the third file is a potential pestware file and to report results of that analysis to a user.
8. The system of claim 7 wherein the sweep speedup module is configured to cause the at least one processor to sort, by location, the first file, the second file and the third file so as to generate a sorted list of files.
9. The system of claim 8 wherein the sweep speedup module is configured to cause the at least one processor to sequentially retrieve the first, the second and the third files in an order the first, the second and the third files appear in the sorted list of files.
10. The system of claim 8 wherein the at least one file storage device is a disk drive, and wherein the sweep speedup module is configured to cause the at least one processor to sort the first file, the second file and the third file by the cluster numbers of the first file, the second file and the third file so as to generate the sorted list of files.
11. The system of claim 10 wherein the sweep speedup module is configured to cause the at least one processor to sequentially retrieve the first, the second and the third files in an order the first, the second and the third files appear in the sorted list of files.
12. The method of claim 7 wherein the sweep speedup module is configured to cause the at least one processor to identify each of the first, the second and the third files by utilizing an operating system of the protected computer to identify the location of each of at least the first file, the second file and the third file.
13. The method of claim 7 wherein the sweep speedup module is configured to cause the at least one processor to identify each of the first, the second and the third files by circumventing the operating system of the protected computer while identifying the location of each of at least the first file, the second file and the third file.
14. A method for scanning files on a protected computer for pestware comprising:
identifying a location of each of a plurality of files in at least one file storage device of the protected computer;
storing a list of the location of each of the plurality of files;
sorting the list of the plurality of files so as to generate a sorted list;
accessing, sequentially, each of the plurality of files as listed in the sorted list so as to retrieve information from each of the plurality of files;
analyzing the information from each of the plurality of files so as to determine whether any of the plurality of files are potential pestware files; and
reporting to a user results of the analyzing the information from each of the plurality of files.
15. The method of claim 14 wherein the identifying includes utilizing an operating system of the protected computer to identify the location of each of the plurality of files.
16. The method of claim 14 wherein the identifying includes circumventing the operating system of the protected computer while identifying the location of each of the plurality of files.
17. The method of claim 14 wherein the identifying the location of each of a plurality of files includes identifying a cluster number of each of the plurality of files in a disk drive of the protected computer.
18. The method of claim 14 wherein the accessing includes accessing an operating system of the protected computer to access each of the plurality of files.
19. The method of claim 14 wherein the accessing includes circumventing an operating system of the protected computer while accessing each of the plurality of files.