This paper presents the results of a Diskeeper Corporation study that examines the effects of disk fragmentation on virus scan time to verify and measure the magnitude of virus scanning speed improvement.
For years, we've received anecdotal data from Diskeeper customers that one of the benefits of using Diskeeper to handle file and free space fragmentation on their desktop systems was a significant reduction in the time it takes to conduct virus scans.
With virus attacks rippling through the internet-the quick succession of recent worm attacks like Sobig, Blaster, and the Welchia worm outbreaks-has created a security environment of unprecedented intensity and has increased the importance of a fast virus scan capability on desktop systems as part of an organization's overall security strategy.
At the request of one of our enterprise customers, Diskeeper Corporation recently did a study of the effects of disk fragmentation on virus scan time to verify and measure the magnitude of virus scanning speed improvement.
Test Environment
We tested the top four anti-virus products that collectively represent about 90% of the U.S. volume license market for anti-virus software:
- Symantec Antivirus 2003 - McAfee Pro 7.02 - Trend Micro PC-cillin 10.03 - Panda Titanium Antivirus 2004
When a defragmenter is not regularly run, the systems will build up significant levels of fragmentation. The requested test scenario was one where the levels of fragmentation should be consistent with a desktop that is not regularly defragmented and the hardware should represent desktops that might have been purchased in the last 6 months, meaning a P4 processor or equivalent and 256 MB of RAM or greater. The mix of files on the test partition should include MS Office and other typical popular applications and file types. The test cases were saved as binary images so that the tests could be repeated.
We set up two typical corporate desktop systems.
Test Procedure
The four top anti-virus software packages were tested in turn, restoring the binary disk image each time. Only the manual virus scan of each product was run, with other system monitoring options turned off in order to minimize timing variables.
Before testing each antivirus product, the disk was restored from the binary image to the fragmented test state described above, and then the virus scan was run and the scan time recorded. The disk was then defragmented using Diskeeper's "Maximum Performance" defragmentation method (the default setting). When the defragmentation was complete, the virus scan of the same product was run again, with the new time recorded.
Conclusion
Antivirus Scans are significantly faster on desktop systems with regularly defragmented files and free space. As capacity to quickly respond to new anti-virus attacks is a critical component of any organization's security plan, software that automatically keeps systems defragmented should not be overlooked as the tool that makes fast antivirus scans possible.
