Anti-Virus Software and Disk Fragmentation

ANTIVIRUS SOFTWARE AND
DISK DEFRAGMENTATION
®For years, we've received anecdotal data from Diskeeper customers that one of the benefits of using Diskeeper to handle file and free space fragmentation on their desktop systems was a significant reduction in the time it takes to conduct virus scans. With virus attacks rippling through the internet-the quick succession of recent worm attacks like Sobig, Blaster, and the Welchia worm outbreaks-has created a security environment of unprecedented intensity and has increased the importance of a fast virus scan capability on desktop systems as part of an organization's overall security strategy. At the request of one of our enterprise customers, Diskeeper Corporation recently did a study of the effects of disk fragmentation on virus scan time to verify and measure the magnitude of virus scanning speed improvement. Test Environment We tested the top four anti-virus products that collectively represent about 90% of the U.S. volume license market for anti-virus software: ƒ Symantec Antivirus 2003 ƒ McAfee Pro 7.02 ƒ Trend Micro PC-cillin 10.03 ƒ Panda Titanium Antivirus 2004 When a defragmenter is not regularly run, the systems will build up significant levels of fragmentation. The requested test scenario was one where the levels of fragmentation should be consistent with a desktop that is not regularly defragmented and the hardware should represent desktops that might have been purchased in the last 6 months, meaning a P4 processor or equivalent and 256 MB of RAM or greater. The mix of files on the test partition should include MS Office and other typical popular applications and file types. The test cases were saved as binary images so that the tests could be repeated. We set up two typical corporate desktop systems as follows: Desktop #1: Desktop #2: Windows 2000 Professional SP3, 80GB Windows XP Professional SP1, 80GB Hard Hard Drive, 512 Ram, AMD Athlon 2700+ Drive, 512 Ram, Intel Pentium 4 2400 Test partition: 20GB 114,291 files. Test Test Partition: 40 GB test partition with partition condition before: 342,283 200,001 files. Test partition condition excess fragments (average 3.99 before: 1,460,850 excess fragments fragments per file). 60% free space. (average 8.30 fragments per file). 35% free space. Test Procedure The four top anti-virus software packages were tested in turn, restoring the binary disk image each time. Only the manual virus scan of each product was run, with other system monitoring options turned off in order to minimize timing variables. Before testing each antivirus product, the disk was restored from the binary image to the fragmented test state described above, and then the virus scan was run and the scan time recorded. The disk was then defragmented using Diskeeper's "Maximum Performance" defragmentation method (the default setting). When the defragmentation was complete, the virus scan of the same product was run again, with the new time recorded. Test Cases and Results
Test Case Antivirus Software Tested Scan time before Scan time after Time Improvement defragmentation* defragmentation Saved Percentage Desktop #1 McAfee Pro 7.02 1:34:43 0:52:34 0:42:09 44.50% Desktop #1 Symantec Antivirus 2003 1:00:11 0:35:31 0:24:40 40.99% Desktop #1 Trend Micro PC-cillin 10.03 1:00:40 0:31:05 0:29:35 48.76% Desktop #1 Panda Titanium Antivirus 2004 1:11:35 0:27:46 0:43:49 61.21% Desktop #2 McAfee Pro 7.02 2:14:06 1:15:56 0:58:10 43.38% Desktop #2 Symantec Antivirus 2003 1:16:55 0:59:13 0:17:42 23.01% Desktop #2 Trend Micro PC-cillin 10.03 1:10:55 0:45:34 0:25:21 35.75% Desktop #2 Panda Titanium Antivirus 2004 1:39:03 0:43:29 0:55:34 56.47% * Times shown are in hours, minutes and seconds. Conclusion Antivirus Scans are significantly faster on desktop systems with regularly defragmented files and free space. As capacity to quickly respond to new anti-virus attacks is a critical component of any organization's security plan, software that automatically keeps systems defragmented should not be overlooked as the tool that makes fast antivirus scans possible. Diskeeper Corporation ? 7590 North Glenoaks Boulevard ? Burbank ? California 91504-1052 ? USA Toll Free 800-829-6468 ? Phone 818-771-1600 ? Fax 818-252-5514 ? www.diskeeper.com © 2005 Diskeeper Corporation. All Rights Reserved. Diskeeper, Diskeeper Cor... [download for more]