1. Getting Started with MetaDefender Drive


Boot the device with MetaDefender Drive

  • Insert MetaDefender Drive into the device's USB port.

  • Power up the target device and enter the BIOS (Most devices require holding F-12 or similar key immediately on system boot to enter the BIOS).

  • Select the USB as the boot option, exit and save settings within the BIOS.

  • Alternatively some BIOS' allow for one-time boot from a selected drive, this may vary based on the target system you are trying to process

Accept Terms


  • Upon first use the MetaDefender Drive will ask you to accept the terms of usage.

Configure the internet connection

  • With the wired connection, MetaDefender Drive detects internet connection and proceed to the next step automatically.

  • To connect WiFi, click the Network connection icon on the top-right, and select the WiFi network with which you would like to connect .

  • To start an offline analysis, wait for several seconds after a delay the MetaDefender Drive UI should prompt to "Skip Internet Connection" via pops up. Please click the skip button to proceed.



  • MetaDefender Drive will automatically update if an active internet connection is enabled

  • Alternatively, for offline or air-gapped environments you can copy downloaded engine updates in the /updates folder on the NTFS "MetaDefender Drive" partition Provide Link

Initializing engines


  • Once updates have been skipped or applied then MetaDefender Drive will begin initializing available engines. The count includes several internal tools such as FileType and Archive Engine which may show in the count in addition to the AV package you have purchased

  • Occasionally, an update of an engine will not be applied correctly, if after 5-10 minutes the initialization appears to be stuck then you can choice to "Skip" and process with available engines. Alternatively you can consult with OPSWAT Customer Support to guide you through correcting your issue

Scan in Progress


  • During this phase of processing the MetaDefender Drive is processing every file on the underlying system (assuming encryption keys have been provided, and no other access barriers are present). Each file is submitted to the underlying MetaDefender system to process with a variety of Antivirus, Vulnerability, and Utility engines

  • This stage can take several minutes to hours. ETA provided is a best guess based on previous rate of processing, and file size, this ETA may update as processing continues.



  • Once processing has finished you will be instructed that a final report has been written and its location on the NTFS "MetaDefender Drive" partition under /reports

  • Persisting the report to the external partition is required to make sure data is not lost once the target system is powered off and MetaDefender Drive is removed

  • It is recommended that you review the report on another system once processing has finished