Choosing scan paths: where to point the agent first

MyVaultMate starts with the usual folders (your user folder and OneDrive on Windows), and you can add, replace or exclude folders from the dashboard. That is a feature: you control the scope, and you can remove any path at any time. It also raises a fair question on day one. Where should you point the agent first? The short answer is to start where sensitive files most likely collect, then widen the circle.

Start with where work actually happens

Sensitive data rarely sits in neatly named folders. It sits where people put things while they are busy. For a first pass on each computer, look at these locations:

• Documents and Desktop. The most common home for "I will file this later."
• Downloads. Email attachments and portal downloads end up here and stay for years.
• The shared client folder. Whatever your office calls it, this is the main working area.
• Scanner output folders. Many office scanners drop PDFs into a folder on one computer. Those PDFs are often intake forms, IDs and signed documents.

By default the scan skips AppData and caches, which keeps results focused on files people created or saved rather than program internals.

Then add synced folders

The agent can scan synced OneDrive and Google Drive folders on a computer. That is useful because a synced folder is a copy that lives on the local disk, and every computer that syncs it holds the same files. Scanning it on one machine usually tells you what is in the whole folder. If several people sync the same shared folder, you do not need to point every computer at it on day one; pick one machine, then check others later to catch any private copies.

Keep in mind that the agent reads files that are present on the disk. A cloud-only file that has never been downloaded to that computer is not something the agent can read locally.

Do not forget external and USB disks

Backup drives and USB sticks tend to be the least supervised copies of your data. Someone made a backup of the whole client folder two years ago, and it has been in a desk drawer since. The agent can scan external and USB disks while they are connected. Plug in each drive you can find and scan it as a separate path. If a drive turns out to hold a full copy of old client files, that finding is worth fixing before almost anything else on the list.

A sensible order

1. Pick one computer, the busiest one, and scan Documents, Desktop and Downloads.
2. Add the main shared working folder and any scanner output folder.
3. Add the synced OneDrive or Google Drive folder.
4. Scan external and USB disks, one at a time.
5. Repeat the same set of paths on the next computers.

Because the first scan of a path is a full scan and later scans can be incremental, adding a path later costs you nothing extra. The agent reads the new path in full once and then only re-reads changed files.

Keeping scans light

If you scan a very large location, the balanced speed keeps the machine responsive: the scan backs off while someone is working and speeds up when the computer is idle. For a big first scan, many offices still choose to start it near closing time.

Being honest about what is out of scope

Some files are not read: pictures, videos and recordings, PDFs that are only scanned pictures of each page, RTF and PowerPoint files, Outlook .pst data files and zip archives. They will not produce findings, but each one the scan looks at is listed as “Not scanned” with a risk score of 70, so it stays on your list. Make a note to review those files by hand.

It also helps to write down what you chose not to scan, and why. If you are working on a written security program, the list of locations you reviewed is part of your documentation. You can add or remove a path whenever your needs change. For a look at how a finished report presents results by computer, see /sample.