The Art of SQL Server FILESTREAM - Red Gate Software

Chapter 12: Planning, Configuration and Best PracticesConfiguring antivirus"Should I configure my antivirus software to scan the FILESTREAM data?" is a very interestingquestion. The answer depends upon various factors specific to the environment,such as the source of data, or the way FILESTREAM files are processed. If you are storingdata that originated from untrusted sources (for example, end-user file uploads, perhapseven by users outside your own organization), you may want to enable virus scans.However, it is important to recognize that virus scanning software may not be 100%effective because it will not be able to determine the file type of the stored data if thescanner uses the file extension for that purpose.If you decide to configure your antivirus software to scan the FILESTREAM datacontainer, make sure you do not configure it to delete the infected files. If the antivirussoftware deletes an infected file from the FILESTREAM data container, you will end upwith a corrupted database and it will be hard for you to figure out what went wrong andsubsequently recover the database.It is therefore recommended that you configure your antivirus software to quarantinethe infected files rather than deleting them. If a FILESTREAM data file is infected andthe antivirus software moves it to a quarantine folder, you can run DBCC CHECKDB toidentify the missing files in the FILESTREAM data container and match it with the filesin the quarantine folder. Chapter 7 included the options for recovering from missingFILESTREAM data files.You may also consider an alternative approach, in which the virus scanning is done atthe time of saving the FILESTREAM data. Many antivirus software vendors provideSDKs, which expose API functions that you can use to scan a memory stream. Suchan API function can be called from your .NET or Win32 code just before writing theFILESTREAM data. This approach is most effective if your application writes dataexclusively using the streaming I/O APIs and not using T-SQL statements.446