[clamav-users] ClamAV Scan - Data Read vs Data Scanned

[Paul Kosinski]

When I first saw this message, I quickly concluded it was a roundoff
behavior. But I still think it is a bad message that should be fixed.

First, most file managers that only display file sizes in "human
readable" form, still display a non-zero size for small files. Second,
it is not logically impossible (in principle) that a file be enumerated
while not having any data read or scanned.

Third, and perhaps most important, it can make users new to ClamAV
doubt its design, implementation or reliability.



On Sun, 1 Nov 2020 19:53:18 -0800
Al Varnell via clamav-users <clamav-users at lists.clamav.net> wrote:

> The eicar test file is 68 bytes long which is .000068 MB which rounded to two significant digits is 0.00 MB both scanned and read.
> 
> There are various limits, depending on file and archive types as to how much is read and/or scanned. In most cases they will be exactly the same.
> 
> -Al-
> 
> > On Nov 1, 2020, at 19:40, Ankur Sharma via clamav-users <clamav-users at lists.clamav.net> wrote:
> > 
> > Hi All,
> > 
> > I tried to scan an eicar test file and got the following scan output:
> > 
> > {'Scanning /tmp/bucket-file-upload/eicar_com.zip!ZIP': 'eicar.com <http://eicar.com/>', '/tmp/bucket-file-upload/eicar_com.zip': 'Win.Test.EICAR_HDB-1 FOUND', '/tmp/bucket-file-upload/eicar_com.zip!(1)ZIP': 'eicar.com <http://eicar.com/>: Win.Test.EICAR_HDB-1 FOUND', 'Known viruses': '8931107', 'Engine version': '0.102.4', 'Scanned directories': '0', 'Scanned files': '1', 'Infected files': '1', 'Data scanned': '0.00 MB', 'Data read': '0.00 MB (ratio 0.00:1)', 'Time': '22.963 sec (0 m 22 s)'}
> > 
> > Though it correctly mentions that the 'Infected files' is '1'. It mentions that data scanned and data read is 0.00 MB. Can someone please help me and confirm what is Data read and Data scanned ? How are these different?
> > 
> > Thanks a lot for your time.
> > 
> > -- 
> > regards
> > Ankur