Accelerated file scanning

A method for testing files for presence of a predefined data pattern, comprising:

• for each one file of a first plurality of files, deriving physical address data from logical address information for said each one file;
• for said each one file of the first plurality of files, creating one or more entries in a first data structure, each one entry of said one or more entries comprising file information and the derived physical address data for a file portion of said one file;
• reading in data content corresponding to a set of multiple entries in the first data structure, said reading performed in a data streaming manner consisting of up to three data streaming operations, including a first data streaming operation in a first drive head radial movement direction starting at a given cylinder and progressing to an extreme cylinder, followed by a second data streaming operation in a second radial movement direction starting from the extreme cylinder to an opposite extreme cylinder, and followed by a third data streaming operation in the first drive head radial movement direction starting from the opposite extreme cylinder;
• storing the read data content in a buffer;
• reading file portions from the buffer for each one file portion of a second plurality of files, wherein the first plurality of files comprises at least the second plurality of files;
• and
• testing the read file content for presence of the predefined data pattern;
• wherein each one of said up to three data streaming operations comprises:
• testing a current cylinder to determine whether data content is for a file portion to be tested;
• for first data content corresponding to a file portion to be tested, reading said first data content from the tested cylinder as the drive head moves along the tested cylinder when the tested cylinder is found to include said data first data content;
• advancing the drive head in a radial direction to a next cylinder;
• and
• repeating the testing current cylinder, reading said first data content, and advancing for duration of said one data streaming operation.

A computer program embodied on a computer-readable storage medium for testing files stored on a hard drive for viruses, comprising:

• a mapping code segment that generates a physical sectors map of the hard drive, the map including sector location of file contents of said stored files;
• a platter read code segment that reads in data content, corresponding to a set of multiple files to be tested, in a data streaming manner using up to three data streaming operations, comprising a first data streaming operation in a first drive head radial movement direction starting at a given cylinder and progressing to an extreme cylinder, followed by a second data streaming operation in a second radial movement direction starting from the extreme cylinder to an opposite extreme cylinder, and followed by a third data streaming operation in the first drive head radial movement direction starting from the opposite extreme cylinder;
• and
• a pattern detection code segment that tests the read file portions against a plurality of virus definitions;
• wherein said platter read code segment and said pattern detection code segment are executed in parallel, and
• wherein a data streaming operation of said platter read code segment comprises code for testing a current cylinder to determine whether data content is for a file portion to be tested, code for reading data content from the tested cylinder as the drive head moves along the tested cylinder when the tested cylinder is found to include data content for a file portion to be tested, code for advancing the drive head in a radial direction to a next cylinder;
• and code for repeating the testing code, reading code and advancing code for duration of said one data streaming operation.