Learning Outline

• 1. Basic File Scanning — `yara rules.yar target.exe`
• 2. Recursive Directory Scanning — `-r` flag for entire directory trees
• 3. File Filters — `--include` and `--exclude` patterns
• 4. Size Limits — `--max-size` to skip large files
• 5. Forensic Images — Scanning E01, raw dd images (with mounting or direct I/O)
• 6. Parallel Scanning — `-p` threads for multi-core performance
• 7. Handling Archives — Scanning ZIP, RAR, TAR contents
• 8. Network Drives — Scanning mounted SMB/NFS shares

🔗 Resources

• 📖 Filesystem Scanning Documentation
• 🔍 Scanner Internals