OPSWAT MetaDefender User manual

© 2020 OPSWAT, Inc. All rights reserved. OPSWAT®, MetadefenderTM and the OPSWAT logo are trademarks of OPSWAT, Inc.
All other trademarks, trade names, service marks, service names, and images mentioned and/or used herein belong to their
respective owners.
MetaDefender Drive 3.5.0

Table of Contents
Overview 5
Key Features 6
Supports Encrypted Disks 7
1. Getting Started with MetaDefender Drive 8
Boot from MetaDefender Drive 8
Establish Internet Connectivity (optional) 9
Upgrade Drive Software 10
License Remediation 11
End User License Agreement 13
Update Engines 13
Disk Status & Remediation 14
2. Processing Your Device 17
Configuring the Scan 17
Scan in Progress 18
3. Results & Reporting 20
Results Dashboard 20
Report File 21
Remote Report File using Central Management 22
4. Settings & Preferences 23

License Renewal 23
Localization 24
5. Working with OPSWAT Central Management 26
6. Advanced Usage 27
Offline Activation 27
Obtain Deployment ID: 27
Request an License File for Offline Activation: 29
Download License File: 29
Copy License File to MetaDefender Drive: 30
Boot MetaDefender Drive: 31
Offline updates 32
Updating MetaDefender Drive Software 32
Updating Engine Definitions 35
Permanently unlock BitLocker 36
How can I tell if a drive is encrypted with BitLocker? 36
Unlocking Bitlocker using a Recovery Key File 37
Pre-configured Settings 43
1. Pre-configuration 43
7. Troubleshooting Your Drive 82
System Requirements 82
Rebooting after Unintended Stop 82
Restoring MetaDefender Drive 83
Generate a Support Package 83
8. Release Notes 85
9. Legal 86

Copyright 86
DISCLAIMER OF WARRANTY 86
COPYRIGHT NOTICE 86
MetaDefender Export Classification 86

3.5.0 5
Overview
MetaDefender Drive provides an advanced analysis solution in a USB form factor that embeds
multiple anti-malware engines and OPSWAT file-based vulnerability detection capabilities.
MetaDefender Drive is able to quickly and easily boot into any suspicious (x86/x64 based
architecture) device in an organization. After analysis is complete MetaDefender Drive provides
a comprehensive report on the state of the device without modifying the underlying filesystem
leaving it at rest.

3.5.0 6
Key Features
No software installation required
Supports online and offline machines, e.g. air-gapped networks.
Supports Windows, macOS, Linux
Supports Full and Partial path processing
Included device integrity check (all Editions)
Includes multi-scanning commercial anti-malware packages (number of engines based
on Edition)
Includes File-Based Vulnerability Analysis (patented) (available on select Editions)
Includes Data Loss Protection (available on select Editions)
Report generated as PDF, Text, and JSON
Works with OPSWAT Central Management

3.5.0 7
Supports Encrypted Disks
MetaDefender Drive can unlock encrypted hard disks if the decryption/recovery keys are made
available.
MetaDefender Drive supports the following full disk encryption technologies:
Windows BitLocker: How to Unlock BitLocker
macOS FileVault (Experimental)
LUKS (Linux Unified Key System)

3.5.0 8
1. Getting Started with MetaDefender Drive
MetaDefender Drive offers a Setup Wizard during the first use. This Getting Started section
covers this setup.
System Requirements
PCs: Windows® 7, 8, 8.1, 10
Macs: Intel Based Macs from 2006 to 2017
Linux: Debian 5 based (or newer), RHEL 6 based (or newer)
Minimum 4GB of RAM.
USB Type A port. USB Type C is not supported.
Boot from MetaDefender Drive
Turn OFF your target device.
Insert MetaDefender Drive into the device's USB Type A port.
Turn ON the target device and enter the BIOS.
Select the USB as the boot option, exit and save settings within the BIOS.
Alternatively some BIOS' allow for one-time boot from a selected drive, this may vary
based on the target system you are trying to process

3.5.0 9
Establish Internet Connectivity (optional)
If you do not currently have an active internet connection, then you will be prompted to
establish one via the Fix Internet button.
If you are in an offline environment, then you may continue without an internet
connection but will have to skip upgrading the Drive to its latest version, in addition to
providing engine updates via the offline workflow.

3.5.0 10
Upgrade Drive Software
Once an Internet connection has been established, the MetaDefender Drive will check to
make sure its software is on the most current version.
It is highly recommended that you upgrade your MetaDefender Drive if prompted.
In the event you are using the MetaDefender Drive in an offline environment, you can
use the Skip Update button.