Identity Scanning speeds up file processing by identifying files that have already been scanned in previous runs. When MDSS (MetaDefender Storage Security) detects that a file hasn't changed since the last scan, it reuses the existing scan results instead of re-scanning the file.
This feature is useful for backup datasets where many files stay the same across multiple scan cycles, and for recurring scans of the same dataset.
Benefits
Improves performance for backup datasets and recurring scans
Reduces scanning time by skipping unchanged files
Keeps complete reporting while avoiding redundant work
Maintains security with customizable rescan intervals
How it works
Identity Scanning uses file metadata to check whether files have been scanned before. Here's what happens:
Mount backup repositories as NFS/SMB file shares to MDSS
Enable Identity Scanning in your workflow and set a scan interval (for example, 3 days)
First scan: All files are scanned (no stored results exist yet)
Later scans: Only new or changed files are scanned; unchanged files use cached results
You get better performance while keeping full security coverage
Rescan interval
To maintain security, Identity Scanning includes a rescan interval. Even files that haven't changed get rescanned after the time period you configure. This ensures nothing slips through the cracks.
Deep CDR and Real-Time Processing are currently not supported by Identity Scanning.
Things to know
Identity Scanning works with On-Demand and Scheduled scans only
You cannot start Real-Time Processing with Identity Scanning enabled
The feature checks file metadata to identify files accurately
Configuration
Setting up identity scanning
Configure Identity Scanning from the Discovery tile in your workflow:
Create or edit a Standard Workflow with scanning enabled
Turn on "Enable Identity Scanning"
Set the "Scan Interval (Days)" value
Save your changes
Scan interval
Choose how often MDSS will rescan files to check for changes. For example, if you enter "3", MDSS will scan every 3 days to verify files that haven't changed.
Reading scan results
What happens during scans
First Scan
All files in storage are scanned
No identity matches exist in the database yet
All files show as "Scanned"
Later Scans
New or changed files are scanned
Unchanged files use stored results and show as "Stored"
Reports show all files, whether scanned or stored
What the labels mean
Identity: Scanned
Files that were scanned in this run
Includes new files and files changed since the last scan
Identity: Stored
Files that were skipped during scanning
These files haven't changed since the last scan
Results come from stored data
Using Reports
Dashboard
When a scan with Identity Scanning runs, you'll see an "Identity Scan" indicator on the scan card.
Report list
Reports that used Identity Scanning show an icon next to the report name.
Report details
Inside a report, you'll find:
Summary Cards
Identity Scanned - the number of files scanned in this run
Identity Stored - the number of files that used stored results
Filters and Columns
Filter by "Identity Status" to see only "Scanned" or "Stored" files
Each file shows its status in the table
Active Scans
See Identity Scanned and Identity Stored counts in real-time
Filter the file table by Identity Status while scans run
Special cases
Files that are always scanned
Even with Identity Scanning turned on, some files always get scanned:
Manual reprocessing - if you manually reprocess a file, it gets scanned regardless of identity status
Different Scan Instance - if a file was scanned with a Scan Instance that's not in your current Workflow's Scan Pool, it gets scanned again
After the interval expires
When you run a scan after your configured interval (like 3 days), all files get scanned again even if they haven't changed. This keeps your security coverage complete.
Example workflow
Here's how Identity Scanning works in practice:
Create a workflow with Identity Scanning turned on and a 3-day interval
Run the first scan
All files are scanned
Report shows all files as "Identity: Scanned"
Run a second scan (within 3 days)
Unchanged files show as "Stored"
Only new or changed files actually get scanned
Run a third scan (after 3 days)
All files get scanned again, whether they changed or not
This keeps your security coverage up to date
Tips for Using Identity Scanning
Identity Scanning works well for backup datasets where most files stay the same
Pick a scan interval that balances security needs with performance
Look at Identity Scanned vs. Identity Stored numbers to see how your files change over time
Use Identity Scanning with scheduled scans for automated security coverage