---
title: "Start-VBRScanUnstructuredBackup"
description: "This cmdlet starts an on-demand scan of file backup or object storage backup restore points with Veeam Threat Hunter or YARA scan."
canonical: "https://helpcenter.veeam.com/docs/vbr/powershell/start-vbrscanunstructuredbackup.html"
breadcrumb: "Veeam PowerShell Reference > Veeam PowerShell Reference > Managing Security Settings > Malware Detection > Start-VBRScanUnstructuredBackup"
dateModified: "2026-08-19"
---

# Start-VBRScanUnstructuredBackup

## Short Description
Starts a scan of file backups and object storage backups with antivirus or YARA scan.

**Product Edition**: Enterprise, Enterprise Plus, Veeam Universal License

## Syntax
```
Start-VBRScanUnstructuredBackup -Backup <VBRUnstructuredBackup>
 [-RestorePoint <VBRUnstructuredBackupRestorePoint>] -ScanMode <VBRRestorePointScanMode> [-EnableAntivirusScan]
 [-EnableYARAScan] [-YARARule <String>] [-FromPointInTime <DateTime>] [-ToPointInTime <DateTime>]
 [-EnableEntireImageScan] [-RunAsync] [<CommonParameters>]
```

## Detailed Description
This cmdlet starts an on-demand scan of file backup or object storage backup restore points with Veeam Threat Hunter or YARA scan. Veeam Backup & Replication inspects unstructured data stored in NAS backup repositories for malware and suspicious files.

An on-demand scan always runs as a full scan: the cmdlet enumerates all files in the restore point regardless of prior scan history.

## Parameters

<table style="width:100%;" class="Blue_Table">
      <tr style="vertical-align:top">
        <th style="width:20%;">
          <p>Parameter</p>
        </th>
        <th style="width:20%;">
          <p>Description</p>
        </th>
        <th style="width:20%;">
          <p>Type</p>
        </th>
        <th style="width:10%;">
          <p>Required</p>
        </th>
        <th style="width:10%;">
          <p>Position</p>
        </th>
        <th style="width:10%;">
          <p>Accept Pipeline Input</p>
        </th>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">Backup</span></p>
        </td>
        <td>
          <p>Specifies the file backup or object storage backups that you want to scan.</p><p>Accepts the <code>VBRUnstructuredBackup</code> object. To get this object, run the <a href="get-vbrunstructuredbackup.md"><code>Get-VBRUnstructuredBackup</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><a href="vbrunstructuredbackup.md"><code>VBRUnstructuredBackup</code></a></p>
        </td>
        <td style="width:10%;">
          <p>True</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">EnableAntivirusScan</span></p>
        </td>
        <td>
          <p>Defines that Veeam Backup & Replication will scan the file backup or object storage backup restore point with Veeam Threat Hunter or a configured third-party antivirus engine.</p><p>You must provide at least one of the following parameters: <code>EnableAntivirusScan</code> or <code>EnableYARAScan</code>.</p><p>Default: <code>False</code>.</p>
        </td>
        <td style="width:10%;">
          <p><code>SwitchParameter</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">EnableEntireImageScan</span></p>
        </td>
        <td>
          <p>Defines that the cmdlet will scan all restore points in the NAS backup even after it finds the first affected restore point.</p><p><strong>Note</strong>: For unstructured backups, the cmdlet always enumerates all files in each scanned restore point regardless of the value you set. The parameter is preserved for compatibility with the base scan workflow.</p><p>Default: <code>False</code>.</p>
        </td>
        <td style="width:10%;">
          <p><code>SwitchParameter</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">EnableYARAScan</span></p>
        </td>
        <td>
          <p>Defines that Veeam Backup & Replication will scan the file backup or object storage backup restore point with the specified YARA rule.</p><p>If you do not provide this parameter, Veeam Backup & Replication will not scan the restore point with a YARA rule.</p><p>Use the <code>YARARule</code> parameter to specify the YARA rule.</p><p>Default: <code>False</code>.</p>
        </td>
        <td style="width:10%;">
          <p><code>SwitchParameter</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">FromPointInTime</span></p>
        </td>
        <td>
          <p>Specifies the date and time. The cmdlet will scan restore points that were created starting from this date and time.</p><p>Accepts the <code>DateTime</code> object. To get this object, run the <a href="https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/get-date?view=powershell-7.1"><code>Get-Date</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><code>DateTime</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">RestorePoint</span></p>
        </td>
        <td>
          <p>Specifies the restore point that you want to scan. Use this parameter when the <code>ScanMode</code> parameter is set to <code>Specific</code>.</p><p>Accepts the <code>VBRUnstructuredBackupRestorePoint</code> object. To get this object, run the <a href="get-vbrunstructuredbackuprestorepoint.md"><code>Get-VBRUnstructuredBackupRestorePoint</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><code>VBRUnstructuredBackupRestorePoint</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">RunAsync</span></p>
        </td>
        <td>
          <p>Defines that the command returns immediately without waiting for the task to complete.</p>
        </td>
        <td style="width:10%;">
          <p><code>SwitchParameter</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">ScanMode</span></p>
        </td>
        <td>
          <p>Specifies one of the following scan modes:</p><ul><li><code>AllInInterval</code> — Use this mode to scan all restore points in the specified interval sequentially.</li><li><code>FirstInInterval</code> — Use this mode if you are not sure when the attack started. The cmdlet will scan restore points in optimal order until it finds the malware-free restore point.</li><li><code>MostRecent</code> — Use this mode if you consider that a cyber-attack started recently. The cmdlet will scan the restore points sequentially, starting from the most recent restore point, until it finds the latest malware-free restore point.</li><li><code>Specific</code> — Use this mode to scan a specific restore point. If you use this mode, you must provide the <code>RestorePoint</code> parameter.</li></ul>
        </td>
        <td style="width:10%;">
          <p><code>VBRRestorePointScanMode</code></p>
        </td>
        <td style="width:10%;">
          <p>True</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">ToPointInTime</span></p>
        </td>
        <td>
          <p>Specifies the date and time. The cmdlet will scan restore points that were created by this date and time.</p><p>Accepts the <code>DateTime</code> object. To get this object, run the <a href="https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/get-date?view=powershell-7.1"><code>Get-Date</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><code>DateTime</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">YARARule</span></p>
        </td>
        <td>
          <p>Specifies the YARA rule. Veeam Backup & Replication will scan the file backup or object storage backup restore point with this rule.</p><p>Veeam Backup & Replication searches for YARA rules in the <code>YaraRules</code> folder. The default path is: <code>C:\Program Files\Veeam\Backup and Replication\Backup\YaraRules</code>.</p><p>To use a YARA rule, you must specify its name and extension. Veeam Backup & Replication accepts only <code>.yar</code> and <code>.yara</code> extensions.</p>
        </td>
        <td style="width:10%;">
          <p><code>String</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
    </table>

`<CommonParameters>`

This cmdlet supports Microsoft PowerShell common parameters. For more information on common parameters, see [ Microsoft Docs](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_commonparameters?view=powershell-7).

## Output Object
[`VBRSureBackupJobSession`](vbrsurebackupjobsession.md)

## Examples

::: example
### Example 1. Scanning NAS Backup with Antivirus Scan

This example shows how to scan the most recent restore point of a file backup or object storage backup with the antivirus scan.

```
$backup = Get-VBRUnstructuredBackup -Name "FileShare Backup"
Start-VBRScanUnstructuredBackup -Backup $backup -ScanMode MostRecent -EnableAntivirusScan
```

Perform the following steps:

1. Run the [`Get-VBRUnstructuredBackup`](get-vbrunstructuredbackup.md) cmdlet. Specify the `Name` parameter value. Save the result to the `$backup` variable.
2. Run the `Start-VBRScanUnstructuredBackup` cmdlet. Specify the following settings:

   - Set the `$backup` variable as the `Backup` parameter value.
   - Set the `MostRecent` value as the `ScanMode` parameter value.
   - Provide the `EnableAntivirusScan` parameter.

:::

::: example
### Example 2. Scanning Specific NAS Restore Point with YARA Rule

This example shows how to scan a specific NAS restore point with a YARA rule.

```
$backup = Get-VBRUnstructuredBackup -Name "FileShare Backup"
$point = Get-VBRUnstructuredBackupRestorePoint -Backup $backup
Start-VBRScanUnstructuredBackup -Backup $backup -ScanMode Specific -RestorePoint $point[0] -EnableYARAScan -YARARule "ransomware.yar"
```

Perform the following steps:

1. Run the [`Get-VBRUnstructuredBackup`](get-vbrunstructuredbackup.md) cmdlet. Specify the `Name` parameter value. Save the result to the `$backup` variable.
2. Run the [`Get-VBRUnstructuredBackupRestorePoint`](get-vbrunstructuredbackuprestorepoint.md) cmdlet. Set the `$backup` variable as the `Backup` parameter value. Save the result to the `$point` variable.
3. Run the `Start-VBRScanUnstructuredBackup` cmdlet. Specify the following settings:

   - Set the `$backup` variable as the `Backup` parameter value.
   - Set the `Specific` value as the `ScanMode` parameter value.
   - Set the `$point[0]` variable as the `RestorePoint` parameter value.
   - Provide the `EnableYARAScan` parameter.
   - Specify the `YARARule` parameter value.

:::

## Related Commands

- [`Get-VBRUnstructuredBackup`](get-vbrunstructuredbackup.md)
- [`Get-VBRUnstructuredBackupRestorePoint`](get-vbrunstructuredbackuprestorepoint.md)