ENTERPRISE SECURITY

Image Scan

Have an image you need to scan?

Use THOR in your lab to scan forensic images.

For image scanning in a lab, THOR comes with a built-in Imagescan.
Since THOR version 8.23.0 the “–fsonly” switch, which is only used in lab scanning use cases has been modified to support these scenarios optimally.
The “–fsonly” parameter automatically activates the following other options:

  • intense (scan every file intensively regardless of its extension or magic header)
  • noresume (do not resume interrupted scans)
  • norescontrol (do not limit system resources or interrupt scan on low memory)
  • nofast (do not automatically activate fast mode on Windows workstations)
  • nosoft (do not automatically activate soft mode on systems with single core CPUs or low memory)
  • nodoublecheck (do not check for other THOR instances on the same system and do not interrupt scan if another instance has been found)

It also sets the NICE level / PRIORITY of the “thor.exe” process to “NORMAL” instead of “LOWEST”, which is the default.