Patent ID: 8364705

Claim:
A computer-implemented method for determining a file set, the computer-implemented method comprising: identifying a file set, a first computing device comprising the file set; selecting first and second files from the file set with different values in a first property field by: identifying the first file in the file set, the first file comprising a first value in the first property field; searching for an additional file in the file set that comprises a value different than the first value in the first property field; while searching for the additional file, identifying the second file in the file set, the second file comprising a second value in the first property field, the first value being different than the second value, wherein the first and second files are selected in a manner that enables a second computing device to use a first file identifier of the first file and a second file identifier of the second file to determine that the first computing device includes the first and second files and a plurality of other files in the file set in addition to the first and second files; transmitting the first file identifier of the first file and the second file identifier of the second file to the second computing device as part of a request to identify known good files, wherein the second computing device is programmed to: identify first and second sets of known-good-file identifiers that include each of the first and second files; identify a first known-good-file identifier in the first set of known-good-file identifiers, the first known-good-file identifier being different than the first and second file identifiers; identify a second known-good-file identifier in the second set of known-good-file identifiers, the second known-good-file identifier being different than the first and second file identifiers; transmit the first and second known-good-file identifiers to the first computing device; receiving the first and second known-good-file identifiers at the first computing device; determining that the file set comprises a file identified by the first known-good-file identifier but does not comprise a file identified by the second known-good-file identifier; transmitting a result of the determination to the second computing device, wherein the second computing device uses the result to determine that the first set of known-good-file identifiers identifies files on the first computing device; receiving, at the first computing device and from the second computing device, the first set of known-good-file identifiers; performing a security scan on the first computing device and skipping files identified by the first set of known-good-file identifiers during the security scan.