Configuring Settings for Deleted Files Detection

To view all currently tracked file extensions, open the TrackedFiles.xml file. The default path is C:\Program Files\Veeam\Backup and Replication\Backup\TrackedFiles.xml.

You can configure tracked file extensions in the following ways:

• Change the file thresholds.
• Update the list of tracked extensions: add custom extensions and remove default ones.
• Add folders to the ignored paths.

Changing File Thresholds

To change scan sensitivity, open the TrackedFiles.xml file and specify new values for the following thresholds:

• Thresholdpercent — the percentage of files with the specified extension that must be deleted before a malware detection event is created. The default value is 50.
• Thresholdfiles — the minimum number of files with the specified extension that must be deleted before a malware detection event is created. The default value is 100.

Make sure that you configure the values correctly. During a scan, both thresholds must be reached to trigger a malware detection event.

Adding and Removing File Extensions

To start tracking a custom file extension, open the TrackedFiles.xml file and add the FileMaskData element with the following attributes:

To stop tracking specific file extensions, delete the FileMaskData element for the file extension in the TrackedFiles.xml file. You can also remove default extensions.

Adding Ignored Folders

By default, ignored folders are inherited from the SuspiciousFiles.xml file and located at the beginning of the TrackedFiles.xml file. To add a specific folder to the ignored paths:

1. Open the TrackedFiles.xml file.
2. Go to the IgnoredPaths element.
3. Add a new Path attribute with the folder name as shown in the example below.