Google Drive SDK - Upload and Virus Scan

Question

I am building a batch upload process for Google Drive. I have been trying to confirm that all files upload via the API are also scanned for viruses and malware, but can not find any documentation on this. Does anyone know if 1: All files are scanned, 2: if there is a API call to get the scan results or if a standard error is cast back if a file is infected? IF you can point me to any documentation on this would be fantastic.

-Eg

Answer 1

Virus scanning: Google Drive scans a file for viruses before the file is downloaded or shared. If a virus is detected, users can't share the file with others, send the infected file via email, or convert it to a Google Doc, Sheet, or Slide, and they'll receive a warning if they attempt these operations. The owner can download the virus-infected file, but only after acknowledging the risk of doing so.

Seen here

I'm pretty sure it's not an exposed part of the Drive API though. If you want to implement your own, you'll have to find a different API (maybe this?) to scan your files prior to uploading it to Drive.

Answer 2

You can use the EICAR virus test string to understand how Drive behaves with viruses. Here's a globally shared file named eicar.exe which is nothing more than a harmless string but which Google Drive's scan on download will detect as a virus.

You'll notice that:

• Attempts to download my file with files.get(alt=media) will fail with "403: Only the owner can download abusive files."
• Attempts to files.copy() my file into your own Drive will succeed. (This is a nice workaround when the file is not accessible with files.get() for various reasons).
• Attempts to files.get(alt=media, acknowledgeAbuse=true) YOUR copy of the file should succeed.

So to answer your original question, you should be able to follow a files.insert() with a files.get(acknowledgeAbuse=false) to determine if Drive thinks your new file is a Virus (watch for the 403 abuse response).

Be aware that like all Antivirus services, Google is constantly updating it's virus definitions so a file that was not detected as a virus (false negative) may be detected as a virus at a later time and a file that was wrongly detected as a virus (false positive) may no longer be detected as a virus in the future.