Endpoint Protection

There's a checkbox option on the Symantec clients called "Scan when a file is backed up" that I don't quite understand.

How does Symantec know a file is being backed up versus simply being read and written? What backup technologies does Symantec monitor to know a file is being backed up?

Hello,

Enabling the "Scan when a file is backed up" would  scans the files when they are accessed during a backup operation.

Use this option if you did not run a virus check on the files that you want to back up.

Do not enable this option if you want to bypass Auto-Protect for the files that the client backs up. By using this option, you can significantly slow backup operations, because Auto-Protect scans each file that is included in the backup.

The setting applies only to files that are backed up. The client scans the files that it restores from a backup regardless of this setting.

You can lock or unlock this option to prevent or allow user changes.

Typically when a file is backed up, it will be given a different file extension. It will have the same name but the file extension will be different.

i.e. test.doc is the normal file name and the backup will be something like test.bps or test.bpk

SEP is able to differentiate between these.

In Windows XP, the Windows Backup utility allows you to select the files and folders you want backed up and creates a single file with the extension .bkf. In this situation, Symantec may not scan the file with the .bkf extension, but how would it know NOT to scan the folders and files as they are selected, read and stored in the .bkf file?

Details of what you're asking for may be proprietary information. I can't find a good KB article with this type of detailed explanation. You may want to call support to see what they can tell. Or maybe a Symanec employee who checks in on this forum can offer a detailed explanation.

OK. Thanks Brian. Much appreciated.

Hi Mithun,

Would you know the answer to this?

In Windows XP, the Windows Backup utility allows you to select the files and folders you want backed up and creates a single file with the extension .bkf. In this situation, Symantec may not scan the file with the .bkf extension, but how would it know NOT to scan the folders and files as they are selected, read and stored in the .bkf file?

Thanks, Steve.

Hi 

Agree with Brian...

Regard’s

Ajin

Hello,

Whenever a file is created or changed, the operating system activates the Archive Bit or modified bit. Unless you select to use backup methods that depend on a date and time stamp, Symantec Endpoint Protection uses the archive bit to determine whether a file has been backed up, which is an important element of your backup strategy.

Hope that helps!!

Thanks Mithun for the reply.

This now makes perfect sense and does explain how Symantec distiguishes between "normal" file access and file access for the purpose of backing up.

Steve.