I downloaded Sophos for Mac yesterday, and have been scanning my Mac for undetected viruses etc. It has actually picked up quite a few in e-mail attachments and some old Windows files I used to use.
However, because I use Time Machine, many of these same files exist on the Time Machine backup. So I have been scanning the disk Time Machine uses. This looks like it is going to take at least a week. :-(
The problem occurs because of the way Time Machine stores its files. For each backup it does, and there will be typically over 70 of them, Time Machine does not copy files it has already backed up. Instead, it creates a hard link to the copy of the file already on the backup disk. (A hard link means a directory entry exists but just points to the existing file. So for each file which has existed for the whole period of the backup, there will be about 70 hard links.)
Each of those 70+ directories appears to have a full copy of the disk being backed up. Sophos seems to just take a simplistic view and scans every "file" on the disk. In fact, it is mostly just scanning the same files 70+ times. :-(
And since the files containing viruses are found 70+ times, there are 70+ reports of viruses in quarantine.
Scanning a Time Machine backup disk would be speeded up immeasurably if Sophos used some intelligence about this and recognised that it had already scanned a file and didn't need to do it again.
(And the way to deal with files found in a Time Machine backup is to find their location and use Time Machine to "delete all backups" of the file.)
Cheers
David
This thread was automatically locked due to age.
