WO2017084557A1

WO2017084557A1 - File scanning method and device

Info

Publication number: WO2017084557A1
Application number: PCT/CN2016/105906
Authority: WO
Inventors: 汤迪斌; 王剑
Original assignee: 北京奇虎科技有限公司; 北京奇安信科技有限公司
Priority date: 2015-11-16
Filing date: 2016-11-15
Publication date: 2017-05-26
Also published as: CN105389509A

Abstract

A file scanning method and device. The method comprises: receiving a scanning trigger operation of a terminal (S102); acquiring a scanning ending log of a previous scanning operation record, wherein the scanning ending log is a last log record in an incremental log record corresponding to a previous file scanning operation (S104); and finding a position of the scanning ending log according to an incremental log, and performing increment scanning on a file in the terminal according to a log record of a newly-increased part in the incremental log by using the scanning ending log as a start point (S106). Through scanning the increment of a file, the scheme saves time wasted for unnecessary file full scanning, effectively increases the efficiency of file scanning, and meanwhile, saves space resources of a terminal system, thereby ensuring high efficiency and accuracy of file scanning.

Description

Document scanning method and device

Technical field

The present invention relates to the field of computer technologies, and in particular, to a file scanning method and apparatus.

Background technique

With the continuous development of computer technology, the application of the Internet has become more and more extensive, which has made people's life, study and work have a lot of beneficial effects. However, in the process of people using the Internet, electronic devices are vulnerable to viruses and malicious plug-ins. Once a device is infected with a virus, it may cause damage or loss of some important files in the system. In severe cases, it may also cause systemic Oh, which causes huge losses to the user. In order to prevent electronic devices from being attacked by viruses and to ensure that users can use the Internet safely, it is necessary to frequently detect and kill potential viruses of the system and eliminate the interference of malware on the system.

The current anti-virus software scanning virus generally adopts the method of full-disk scanning, that is, enumerating the files in the system to be scanned, for example, enumerating files from the root directory of the C-disk, and transmitting them one by one to the anti-virus engine behind, and multiple anti-viruses. The engine gets a scan after scanning the virus. This scanning method can effectively detect and kill viruses, but because it is used to enumerate files in the system, it is a waste of time and consumes system resources too much. Therefore, it is necessary to create an efficient and safe file scanning method. In the case of ensuring the security of the terminal, not only can the virus be accurately detected, but also the scanning time and system resources can be saved.

Summary of the invention

In view of the above problems, the present invention has been made in order to provide a document scanning method and corresponding apparatus that overcomes the above problems or at least partially solves the above problems.

According to an aspect of the present invention, a file scanning method is provided for performing security scanning on a file in a terminal, wherein the terminal is provided with an incremental log, and when a file in the terminal is changed, the Add a log record to the incremental log, including:

Receiving a scan triggering operation for scanning a file in the terminal;

Obtaining a scan cutoff log of a previous scan operation record, where the scan cutoff log is the last log record in the incremental log record corresponding to the previous file scan operation;

The location of the scan-off log is found according to the incremental log, and the scan-off log is used as a starting point, and the file in the terminal is incrementally scanned according to the newly added partial log record in the incremental log.

According to another aspect of the present invention, a file scanning apparatus is further provided for performing security scanning on a file in a terminal, wherein the terminal is provided with an incremental log, and when a file in the terminal is changed, Adding a log record to the incremental log, the device includes:

a recording module, configured to determine a last log record in the incremental log record corresponding to each scan operation, and record as a scan cutoff log;

An input module adapted to receive a scan triggering operation for scanning a file in the terminal;

An obtaining module, configured to obtain, in the recording module, a scan cutoff log of a previous scan operation record;

The scanning module searches for the location of the scan-off log according to the incremental log, and uses the scan-off log as a starting point to increment the file in the terminal according to the newly added partial log record in the incremental log. scanning.

According to still another aspect of the present invention, a computer program is provided, comprising computer readable code that, when executed on a computing device, causes the computing device to perform a file scan as described above method.

According to still another aspect of the present invention, a computer readable medium storing a computer program as described above is provided.

In the embodiment of the present invention, an incremental log is set in the terminal, and when a file in the terminal is changed, a log record is added to the incremental log. When the scan is triggered, the last log record in the incremental log corresponding to the previous scan operation is obtained, that is, the scan cutoff log, and the terminal only needs to scan the newly added log portion after the cutoff log, so that the file can be safely scanned. Since the incremental log only adds some new logs to the original log, the previously existing logs are not The change occurs, so the present invention only scans the file increments, avoiding the full scan of all the incremental logs from beginning to end, especially in the case of a large number of files, the time spent on file scanning is obviously saved, and the effective improvement is effectively improved. The efficiency of file scanning saves system resources.

The above description is only an overview of the technical solutions of the present invention, and the above-described and other objects, features and advantages of the present invention can be more clearly understood. Specific embodiments of the invention are set forth below.

DRAWINGS

Various other advantages and benefits will become apparent to those skilled in the art from a The drawings are only for the purpose of illustrating the preferred embodiments and are not to be construed as limiting. Throughout the drawings, the same reference numerals are used to refer to the same parts. In the drawing:

1 is a flow chart showing a file scanning method according to an embodiment of the present invention;

2 is a schematic flow chart of a file scanning method according to another embodiment of the present invention;

3 is a schematic flow chart of a file scanning method according to another embodiment of the present invention;

4 is a schematic structural diagram of a document scanning apparatus according to an embodiment of the present invention;

Figure 5 is a schematic block diagram showing a computing device for performing a file scanning method in accordance with the present invention;

Fig. 6 schematically shows a storage unit for holding or carrying program code implementing the document scanning method according to the present invention.

detailed description

The invention is further described below in conjunction with the drawings and specific embodiments.

In order to solve the above technical problem, an embodiment of the present invention provides a file scanning method. FIG. 1 shows a flow chart of a document scanning method according to an embodiment of the present invention. Figure. Referring to FIG. 1, the method includes at least steps S102 to S106.

Step S102, receiving a scan triggering operation for scanning a file in the terminal.

Step S104: Acquire a scan cutoff log of the previous scan operation record, where the scan cutoff log is the last log record in the incremental log record corresponding to the previous file scan operation.

The method of obtaining the scan-off log depends on the incremental log itself. If the incremental log uses the number of logs, the scan-off log is read and judged whether the read log entry is the last log record. By means of indexing, the last log record can be found and obtained by reading the index.

In a specific embodiment, if the incremental log uses a digital index to obtain the scan cutoff log of the previous scan operation record, the scan cutoff log can be obtained by recording the index number of the scan cutoff log. By adopting the method of recording the index number of the scan cutoff log, compared with directly acquiring the scan cutoff log, on the one hand, the time taken for scanning the incremental log can be saved, the scanning efficiency is greatly improved, and on the other hand, the processing of the scan information is reduced, and the processing is reduced. The possibility of scanning information errors increases the stability of file scanning.

Step S106: Find the location of the scan-off log according to the incremental log, and use the scan-off log as a starting point to perform incremental scanning on the file in the terminal according to the newly added partial log record in the incremental log.

In the embodiment of the present invention, an incremental log is set in the terminal, and when a file in the terminal is changed, a log record is added to the incremental log. When the scan is triggered, the last log record in the incremental log corresponding to the previous scan operation is obtained, that is, the scan cutoff log, and the terminal only needs to scan the newly added log portion after the cutoff log, so that the file can be safely scanned. The incremental log only adds some new logs to the original log. Therefore, based on the original log, only the incremental part of the file is scanned for security, which can effectively avoid the entire disk from all the incremental logs. Scanning, especially in the case of a large number of files, significantly saves the time spent on file scanning, effectively improving the efficiency of file scanning.

In order to make the document scanning method provided by the embodiment of the present invention clearer, the embodiment of the present invention will be described in detail using a specific embodiment. 2 is a flow chart showing a file scanning method in a specific embodiment of the present invention. Referring to FIG. 2, the method includes at least steps S202 to S210.

Step S202, receiving a scan triggering operation for scanning a file in the terminal.

Step S204: When the incremental log is indexed by the number, the index number of the scan cutoff log is recorded, wherein the scan cutoff log is the last log record in the incremental log record corresponding to the previous file scan operation.

Step S206, finding a position corresponding to the index number of the scan-off log according to the digital index of the increment log.

Step S208, starting from the index number corresponding to the scan cutoff log, determining a file for the subsequent scan operation according to the index number corresponding to the newly added partial log record, wherein the file for the file includes the newly added file and/or the existing file. File changes.

In a specific embodiment, the changes to the existing file include at least one of: changes to existing file content; changes to existing file attributes; changes to existing file feature parameters. Among them, the changes of the existing file attributes do not necessarily need to be scanned, some maliciously modified attributes, such as an IE attribute, are maliciously modified, and the title bar above the IE browser is changed to the "welcome to visit ... website" style. It is included in the scope of the existing file attribute changes. For security-compliant file attribute changes, for example, attributes only involve text type modifications (such as word text type conversion to PDF text type) or attributes only involve changes in text modification time (eg 2015-11-10 changed to 2015-11- 13) These file attribute changes do not need to be scanned again. By filtering the files for which the scan operation is directed, file system resources can be saved while saving the time it takes to scan the files.

Step S210, performing incremental scanning on the determined file.

In the embodiment of the present invention, an incremental log is set in the terminal, and when a file in the terminal is changed, a log record is added to the incremental log. When the scan is triggered, the last log record in the incremental log corresponding to the previous scan operation is obtained, that is, the scan cutoff log. The incremental log is indexed by the number, and the index number of the scan-off log is recorded. The position corresponding to the index number of the scan-off log is found according to the digital index of the incremental log, and the index number of the scan-off log is used as the starting point, and the log is incremented according to the index. The index number corresponding to the new part of the log is incrementally scanned for the files in the terminal. Through the screening of the file, the file for the subsequent scanning operation of the index number of the scan-off log is determined, the time for scanning all the files is omitted, and the time taken for the overall scan-increment log is further saved, and the scanning efficiency is greatly improved, and Reduce the processing of scanning information, reduce the possibility of scanning information errors, thereby increasing the stability of file scanning Sex.

FIG. 3 is a flow chart showing a file scanning method according to another embodiment of the present invention. Referring to FIG. 3, the method includes at least steps S302 to S306.

Step S302: Receive a scan trigger operation for scanning a file in the terminal.

Step S304, the terminal is divided into multiple areas, and the scan cutoff log of the previous scan operation record of each area is obtained, wherein the scan cutoff log is the last log record in the sub-increment log record corresponding to the previous file scan operation in each area. .

In a specific embodiment, the storage area of the terminal, especially the terminal, is divided into a C drive, a D drive, and an E drive. After receiving the scan trigger operation, the scan cutoff logs in the C drive, the D drive, and the E drive are simultaneously acquired.

Step S306, searching for the location of the scan-off log in each sub-increment log according to each sub-increment log, and starting from the scan-off log, and performing the file in the corresponding area of the terminal according to the newly added part of the log records in each sub-increment log. Incremental scanning.

In a specific embodiment, the storage area of the terminal, especially the terminal, is divided into a C drive, a D drive, and an E drive. After receiving the scan trigger operation, the scan cutoff logs in the C drive, the D drive, and the E drive are simultaneously acquired. The location of the corresponding scan cutoff log is found according to the incremental log in each disk, and the incremental portion of the incremental log in the C disk, the D disk, and the E disk is simultaneously scanned starting from the scan cutoff log in each disk.

In the embodiment of the present invention, when the terminal is divided into multiple areas, when the file scanning operation is performed on each area, the sub-increment log of the file change operation of the local area is set in each area, and the words in each area of the terminal are The sub-increment log allows simultaneous incremental scanning of files in each region. By scanning the terminal sub-area, each area does not affect each other, and multiple areas can perform sub-increment log incremental scanning in parallel, which greatly improves the efficiency of file scanning.

In a specific example, when the terminal adopts the NTFS (New Technology File System) system, the incremental log uses the USN (update sequence number) file system. NTFS is a recoverable file system. On NTFS partitions, users rarely need to run disk repairs. NTFS uses standard transaction logging and recovery techniques to ensure partition consistency. When a system failure event occurs, NTFS automatically restores file system consistency using log files and checkpoint information. Therefore, the NTFS file system has good security and is suitable for virus scanning. More secure and reliable. In addition, the NTFS file system provides a fault-tolerant structure log that can fully record the user's operations, further protecting the security of the system. The USN file system is a function to record related information in the volume. When Microsoft released NTFS 5.0, it added some new features and improved the old version of the file system. It invited a reliable secretary. That is, the USN file system, which can set the number of files and directories that monitor changes in the partition, and record the modification time and modification contents of the monitoring object. When this function is enabled, for each NTFS volume, when information about adding, deleting, and modifying files occurs, the NTFS file system uses the USN to record the modified time and identifies it as a log with a specific serial number, that is, USN. Log. However, the USN log does not record the specific modification content. Therefore, the USN log record file is small and easy to find. Therefore, USN logs can only work in the NTFS file system.

In a specific embodiment of the present invention, refer to the schematic diagram of the file scanning method shown in FIG. 1, which can be applied to various environments such as virus scanning, spatial finishing scanning, and the like. When applied to virus scanning, if the virus database or the virus engine changes, the scan deadline log recorded in the previous scan is cleared, and the scan in the terminal is scanned due to the change of the virus database or the virus engine during the scan. The security of the previous file may be changed. Therefore, this scan requires a full scan of the files in the terminal to ensure that the virus can be completely and completely detected and prevented, and some files suspected of security are not checked. .

Based on the same inventive concept, the present invention also provides a document scanning apparatus for supporting a document scanning method provided by any one of the above preferred embodiments or a combination thereof. FIG. 4 is a block diagram showing the structure of a document scanning apparatus according to an embodiment of the present invention. As shown in FIG. 4, the apparatus may include at least the following modules: a recording module 410, an input module 420, an acquisition module 430, and a scanning module 440.

The components of the file scanning apparatus and the connection relationship between the parts of the embodiment of the present invention are described below:

The recording module 410 is adapted to determine a last log record in the incremental log record corresponding to each scan operation, and record the scan log as a scan cutoff log;

The input module 420 is adapted to receive a scan triggering operation for scanning a file in the terminal;

The obtaining module 430 is coupled to the recording module 410 and the input module 420 respectively, and is adapted to obtain a scan cutoff log of the previous scan operation record into the recording module 410;

The scanning module 440 is coupled with the obtaining module 430, and finds the location of the scan-off log according to the incremental log, and uses the scan-off log as a starting point to perform incremental scanning on the file in the terminal according to the newly added partial log record in the incremental log.

In an embodiment of the present invention, the obtaining module 430 is further adapted to acquire an index number of a scan cutoff log recorded by the previous scan operation. The scanning module 440 finds a location corresponding to the index number of the scan-off log based on the digital index of the increment log.

In a specific embodiment of the present invention, the scanning module 440 is further configured to: start with a scan cutoff log, and determine, according to the newly added partial log record, a file for which a subsequent scan operation is performed, where the file for the file includes the newly added file and / or changes to existing documents;

Incremental scanning of the determined files.

In an embodiment of the present invention, the scan trigger operation of the receiving terminal determines the last log record in the incremental log record corresponding to each scan operation, and records the scan as the scan cutoff log, starting from the scan cutoff log, according to the new The partial log record determines the file for which the subsequent scan operation is directed, wherein the file for the change includes a new file and/or a change to the existing file. Changes to existing documents include at least one of the following: changes to existing file content; changes to existing file attributes; changes to existing file feature parameters.

In an embodiment of the present invention, the recording module 410 is further adapted to, when the terminal is divided into a plurality of areas, perform a file scanning operation on each area, and set a sub-increment of the file changing operation of the recording area in each area. Log. The recording module 410 determines the last log record in the sub-increment log records in each area corresponding to each scan operation, and records it as a scan cutoff log. The obtaining module 430 acquires the scan cutoff log of the previous scan operation record from the sub-increment log. The scanning module 440 finds the location of the scan-off log according to the sub-increment log in each area, and uses the scan-off log as a starting point to perform incremental scanning on the file in the corresponding area of the terminal according to the newly added part of the log record in the sub-increment log. .

In the embodiment of the present invention, when the terminal is divided into multiple areas, when the file scanning operation is performed on each area, the sub-increment log of the file change operation of the local area is set in each area, and the words in each area of the terminal are The sub-increment log allows simultaneous incremental scanning of files in each region. By scanning the terminal sub-areas, each area does not affect each other, and multiple areas can simultaneously scan the sub-increment log increments, which greatly improves the efficiency of file scanning.

In a specific embodiment of the present invention, when the terminal adopts the NTFS system, the log is incremented. Use the USN file system.

In a specific embodiment of the invention, the file scanning device is adapted for virus scanning and/or spatial finishing scanning. If the file scanning device is used for virus scanning, the recording module 420 is further adapted to: when the file scanning device is applied to the virus scanning, if the virus database or the virus engine changes, the scanning deadline log recorded by the previous scanning is cleared, and the terminal is The incremental log in the scan is performed in a full scan to ensure thorough scanning and killing of the virus.

According to any one of the preferred embodiments or the combination of the preferred embodiments, the embodiment of the present invention can achieve the following beneficial effects:

In the method and device for scanning a file according to the embodiment of the present invention, an incremental log is set in the terminal, and when a file is changed in the terminal, a log record is added to the incremental log. When the scan is triggered, the last log record in the incremental log corresponding to the previous scan operation is obtained, that is, the scan cutoff log is searched, and the position of the scan cutoff log is found according to the incremental log, and the scan cutoff log is taken as the starting point, according to the incremental log. The new part of the log record incrementally scans the files in the terminal. Since the incremental log only adds some new logs based on the original log, in the case that the original incremental log does not change, only the incremental part of the file needs to be scanned for security, which can effectively avoid all incremental logs from scratch. A full scan to the end. In the case of a large number of files, only incremental scanning of files can save time spent on file scanning, effectively improve the efficiency of file scanning, and save system file resources.

In the description provided herein, numerous specific details are set forth. However, it is understood that the embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of the description.

Similarly, the various features of the invention are sometimes grouped together into a single embodiment, in the above description of the exemplary embodiments of the invention, Figure, or a description of it. However, the method disclosed is not to be interpreted as reflecting the intention that the claimed invention requires more features than those recited in the claims. Rather, as the following claims reflect, inventive aspects reside in less than all features of the single embodiments disclosed herein. Therefore, the claims following the specific embodiments are hereby explicitly incorporated into the embodiments, each of which A separate embodiment of the invention.

Those skilled in the art will appreciate that the modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment. The modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components. In addition to such features and/or at least some of the processes or units being mutually exclusive, any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined. Each feature disclosed in this specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent or similar purpose.

In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features that are included in other embodiments and not in other features, combinations of features of different embodiments are intended to be within the scope of the present invention. Different embodiments are formed and formed. For example, in the following claims, any one of the claimed embodiments can be used in any combination.

The various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functionality of some or all of the components of the document scanning device in accordance with embodiments of the present invention. The invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein. Such a program implementing the invention may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

For example, Figure 5 illustrates a computing device that can implement a file scanning method in accordance with the present invention. The computing device conventionally includes a processor 510 and a computer program product or computer readable medium in the form of a memory 520. The memory 520 may be, for example, a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM. Electronic storage such as this. Memory 520 has a memory space 530 for program code 531 for performing any of the method steps described above. For example, storage space 530 for program code may include various program code 531 for implementing various steps in the above methods, respectively. The program code can be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. Such computer program products are typically portable or fixed storage units as described with reference to FIG. The storage unit may have storage segments, storage spaces, and the like that are similarly arranged to memory 520 in the computing device of FIG. The program code can be compressed, for example, in an appropriate form. Typically, the storage unit includes computer readable code 531 ', ie, code readable by a processor, such as 510, that when executed by a computing device causes the computing device to perform each of the methods described above step.

"an embodiment," or "an embodiment," or "an embodiment," In addition, it is noted that the phrase "in one embodiment" is not necessarily referring to the same embodiment.

It is to be noted that the above-described embodiments are illustrative of the invention and are not intended to be limiting, and that the invention may be devised without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as a limitation. The word "comprising" does not exclude the presence of the elements or steps that are not recited in the claims. The word "a" or "an" The invention can be implemented by means of hardware comprising several distinct elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means can be embodied by the same hardware item. The use of the words first, second, and third does not indicate any order. These words can be interpreted as names.

In addition, it should be noted that the language used in the specification has been selected for the purpose of readability and teaching, and is not intended to be construed or limited. Therefore, many modifications and changes will be apparent to those skilled in the art without departing from the scope of the invention. For The disclosure of the present invention is intended to be illustrative, and not restrictive, and the scope of the invention is defined by the appended claims.

Claims

A file scanning method, configured to perform security scanning on a file in a terminal, where an incremental log is set in the terminal, and when a file in the terminal changes, a log record is added to the incremental log. The methods include:

Receiving a scan triggering operation for scanning a file in the terminal;

Obtaining a scan cutoff log of a previous scan operation record, where the scan cutoff log is the last log record in the incremental log record corresponding to the previous file scan operation;

The location of the scan-off log is found according to the incremental log, and the scan-off log is used as a starting point, and the file in the terminal is incrementally scanned according to the newly added partial log record in the incremental log.
The method according to claim 1, wherein if the incremental log is indexed by a number, the obtaining a scan deadline log of the previous scan operation record comprises: obtaining an index number of a scan cutoff log of the previous scan operation record ;

Finding the location of the scan cutoff log according to the incremental log includes: finding a location corresponding to an index number of the scan cutoff log according to the digital index of the incremental log.
The method according to claim 1 or 2, wherein the scanning of the files in the terminal is performed according to the newly added partial log records in the incremental log, starting from the scan-off log, including:

Determining, according to the scan-off log, a file for a subsequent scan operation, where the file for the file includes a new file and/or a change of an existing file;

Incremental scanning of the determined files.
The method of claim 3 wherein the change to the existing file comprises at least one of the following:

Changes in the content of existing documents;

Changes to existing file attributes;

Changes to existing document feature parameters.
The method according to any one of claims 1 to 4, further comprising:

When the terminal is divided into a plurality of areas, when a file scanning operation is performed on each area, a sub-increment log for recording a file change operation of the local area is set in each area;

The files in the corresponding area are incrementally scanned according to each sub-increment log.
The method according to any one of claims 1 to 5, wherein when the terminal adopts a new technology file system NTFS system, the incremental log is an update serial number USN file system.
A method according to any one of claims 1 to 6, wherein the method is applicable to virus scanning and/or spatial finishing scanning.
The method according to claim 7, wherein when the method is applied to a virus scan, if the virus database or the virus engine changes, the scan deadline log recorded in the previous scan is cleared.
A file scanning device is configured to perform security scanning on a file in a terminal, where an incremental log is set in the terminal, and when a file in the terminal changes operation, a log record is added to the incremental log. The device includes:

a recording module, configured to determine a last log record in the incremental log record corresponding to each scan operation, and record as a scan cutoff log;

An input module adapted to receive a scan triggering operation for scanning a file in the terminal;

An obtaining module, configured to obtain, in the recording module, a scan cutoff log of a previous scan operation record;

The scanning module searches for the location of the scan-off log according to the incremental log, and uses the scan-off log as a starting point to increment the file in the terminal according to the newly added partial log record in the incremental log. scanning.
The apparatus according to claim 9, wherein the obtaining module is further adapted to: when the incremental log is indexed by a number, the obtaining a scan deadline log of the previous scan operation record, comprising: acquiring a previous scan operation The index number of the scanned scan-off log;

The scanning module is further adapted to: find a location corresponding to an index number of the scan-off log according to the digital index of the incremental log.
The apparatus according to claim 9 or 10, wherein the scanning module is further adapted to:

Determining, according to the scan-off log, a file for a subsequent scan operation, where the file for the file includes a new file and/or a change of an existing file;

Incremental scanning of the determined files.
The apparatus of claim 11, wherein the change of the existing file comprises at least one of the following:

Changes in the content of existing documents;

Changes to existing file attributes;

Changes to existing document feature parameters.
The apparatus according to any one of claims 9 to 12, wherein the recording module is further adapted to:

When the terminal is divided into a plurality of areas, when a file scanning operation is performed on each area, a sub-increment log for recording a file change operation of the local area is set in each area;

The scanning module is further adapted to incrementally scan files in the corresponding area according to each sub-increment log.
The apparatus according to any one of claims 9 to 13, wherein when the terminal adopts an NTFS system, the incremental log uses a USN file system.
Apparatus according to any one of claims 9 to 14, wherein the apparatus is adapted for virus scanning and/or spatial finishing scanning.
The apparatus of claim 15, wherein the recording module is further adapted to clear the scan cutoff log recorded by the previous scan if the virus or virus engine changes when the device is applied to a virus scan.
A computer program comprising computer readable code, when the computer readable code is run on a computing device, causing the computing device to perform the file scanning method of any of claims 1-8.
A computer readable medium storing the computer program of claim 17.