Show the analysis result before scanning the file again, just like the web GUI?

[PeterDaveHello]

I wonder if the cli can support the behavior just like the web GUI, sometimes, a large file just scanned a few hours ago, and it actually came from an authorized source that doesn't worry us to scan and wait for the result again, just hours or even minutes later after the last scanning. That feature could also saving the resources on VirtusTotal!

[mgmacias95]

Hello @PeterDaveHello,

You can check wether a file is already scanned at VT by doing this:

$ vt file <sha256 of the file you want to check>

Does this fit what you need?

[PeterDaveHello]

Not exactly the same, was just wondering if that can be done in one step, not sure if that'd be considered here?

[mgmacias95]

Hello @PeterDaveHello,

That is not supported. Actually the UI first checks by doing the vt file equivalent call.

If you are worried about doing it in two steps, let me clarify here that if you are the first submitter of a file you won't be charged API quota for uploading it. So it's safe to first check and then, if it's not in VT, scan it.

I hope this helps.

[PeterDaveHello]

Hi @mgmacias95,

Thanks for mentioning the API quota issue, though I'm just lazy about the steps, won't be worried about the API call at all 😆

So looks like the feature like the Web UI will do(check before submit and scan again) won't be supported? Or that's something worth to be considered? 😄 It's fine if that's not something going to happened, just want to ask and see if it's possible, thanks again.

[mgmacias95]

Hello @PeterDaveHello,

Feel free to make a contribution if you want to add that feature. I can provide some guidance on how to do it.

Thanks!

Regards, Marta

[PeterDaveHello]

@mgmacias95, thanks for that! If we add this feature, what new behavior would you like to see? Should we just align the behavior with the WebUI—check if it's scanned by default? Or would an additional parameter like --check-before-scan be needed?

[mgmacias95]

I think it's best to add an additional parameter so the current behaviour is not changed for those who are already used to it.