| 摘要 |
Files are tested for presence of a predefined data pattern, such as a virus definition. For each one file of a first plurality of files, physical address data is derived from logical address information. Also, an entry is made in a first data structure. The entry includes file information and the derived physical address data. For each one cylinder of a hard drive, the first data structure is tested to identify any files having file contents stored in the cylinder. When the testing determines that the first data structure includes an entry having physical address data corresponding to the one cylinder, a read operation I requested to read the cylinder. Such testing and reading is repeated to read in multiple cylinders in a generally sequential order. The cylinder content is stored in a buffer. File content is read from the buffer for each one file of a second plurality of files. The read file content is tested for the presence of the predefined data pattern.
|
