Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 6 subscribers
  • Views 1343 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

FileVault and on-access scanning

Albert

Does Sophos have a definitive answer to whether On-access scanning interacts poorly with FileVault (in 10.6.8, say)?

Seems like turning OFF on-access scanning disables a key feature of Sohpos Anti-Virus?

With on-access scanning disabled, when do files get checked?  On creation?  (Meaning that any viruses alredy on the disk will not be caught unless it is in something copied?)

- Albert

:1005205


This thread was automatically locked due to age.
Parents
  • 0

    Scanning of all sorts can behave poorly with encrypted sparseimage bundles, which are what FileVault 1 uses.  The biggest place this is an issue is with TimeMachine backups that use encrypted sparseimage bundles.  There is no definitive "On-Access scanning will not function well with FileVault" answer, but there are many edge cases where this combination may cause performance degradation or, when combined with other actions not recommended by Apple, loss of data.

    These issues do not affect FileVault 2, as found in OS X Lion (10.7.x).

    On-Access scanning scans any files that have been modified since the last scan, whenever the file is opened for access (read or write).  With on-access scanning disabled, you have to rely on On-Demand scans (running a scan from within SAV, or right clicking a file and scanning it -- or creating a folder action script to scan defined folder contents based on other system activity).  File creation is considered "access" -- as you're basicly writing a new file.

    This doesn't completely answer your question, but I hope it at least clarifies things somewhat.

    :1005241
Reply
  • 0

    Scanning of all sorts can behave poorly with encrypted sparseimage bundles, which are what FileVault 1 uses.  The biggest place this is an issue is with TimeMachine backups that use encrypted sparseimage bundles.  There is no definitive "On-Access scanning will not function well with FileVault" answer, but there are many edge cases where this combination may cause performance degradation or, when combined with other actions not recommended by Apple, loss of data.

    These issues do not affect FileVault 2, as found in OS X Lion (10.7.x).

    On-Access scanning scans any files that have been modified since the last scan, whenever the file is opened for access (read or write).  With on-access scanning disabled, you have to rely on On-Demand scans (running a scan from within SAV, or right clicking a file and scanning it -- or creating a folder action script to scan defined folder contents based on other system activity).  File creation is considered "access" -- as you're basicly writing a new file.

    This doesn't completely answer your question, but I hope it at least clarifies things somewhat.

    :1005241
Children
No Data