$user is not known here, use fileid
Only scan files in the files dir