Avast Free Antivirus: temporary folders / files, persistent / transient caching

[REDACTED]

SSD is my system drive, HDD is my secondary drive. To avoid unnecessary SSD writing I have redirected my system environment variables TEMP and TMP to folders on HDD.

Does anyone know where Avast stores its temp caches / temp data (created during background and normal scans)? Does Avast use only Windows temporary folders (TEMP and/or TMP) or maybe also some custom ones? If I install Avast on SSD should I move any of its folder to HDD? Or maybe should I install Avast fully on HDD?

Some references from the past I've found - my reasons to ask these questions above:
- Avast seems to be bad for SSD system drive
- Avast constant writes to SSD (lscache.dat)
- avast! Antivirus software writing to SSD a lot during scan

[Pondus]

SSD is my system drive, HDD is my secondary drive. To avoid unnecessary SSD writing I have redirected my system environment variables TEMP and TMP to folders on HDD.

If you worry why dont you change it and use SSD for storage?

https://www.quora.com/Does-too-much-read-write-to-SSD-will-shorten-its-lifespan

https://www.cnet.com/how-to/how-ssds-solid-state-drives-work-increase-lifespan/

[REDACTED]

If you worry why dont you change it and use SSD for storage?

I do not mind "normal" writing to SSD, but if some app is going to write "a lot" or "constantly" that is a good reason to move it to another drive. I started this topic to get the opinions from other users - does references I linked are still true or they are just "special cases" or maybe such problem existed in the past but it was corrected in new Avast versions?

PS. Using SSD for storage is a very bad idea in term of costs.

[DavidR]

It is normally the C:\Windows\Temp\_avast_ folder,  since you have changed the  environment variables I don't know if that would also change the location of the avast folder/s.

There is also some Avast folders located in the C:\ProgramData folder.

[REDACTED]

It is normally the C:\Windows\Temp\_avast_ folder,  since you have changed the  environment variables I don't know if that would also change the location of the avast folder/s.

Do you know if Avast uses this temp folder just for downloading / unpacking updates or also during scans to store any temp data it needs?

There is also some Avast folders located in the C:\ProgramData folder.

As far as I know this is location for files shared between all users of PC so it should not matter a lot.
Do you know if Avast intensively uses its installation directory (and/or this one you mentioned) to write any other data than installation files?

I'm just trying to figure out what was the cause of problems in topics I linked in opening post.

I hope these users just haven't moved their temp folders to HDD (which, as you said, are used by Avast) or maybe this was something different.

[DavidR]

the _avast_ is usually used for unpacking/scanning files on completion of said scan the contents are removed, with one exception the file that is keeping track of locked files whilst they are scanned.  If things haven't changed the web shield would also be using this to scan page/download content, along with the file system shield.

In your first link, whilst that topic is very old and as an avast user, I don't know how much may have changed since then, but I would defer to Igor's posts as an Avast Team member.

Your second link, I see no such activity in my lscache.dat, mine is 7KB and whilst it is updated, it isn't on a 1per second basis.

Your third link is not good for comparison given as it is about Avast for Mac and not Avast for Windows.

[Rundvleeskroket]

I have done similar folder redirecting in the past on SSDs. This was in the days that it actually mattered under heavy use (2006 - 2010 ish). The last 5 years at least I haven't bothered. Yes, the SSD wil incur more writes. No, that won't impact SSD lifespan in any significant way.

Think of it this way: you could 'protect' your SSD by preventing most writes to it. By diverting them to a spinner. But that negates the whole point of having an SSD. The difference is likely between wearing it out in 30 years versus in 28 years. Other factors, like capacity becoming unusable, or OS support and hardware changes, wil probably render this model of drive obsolete long before that. Especially with wear leveling and TRIM. The controller might even fail before the NAND does. Endurance on modern drives is into the petabytes or not exabytes.

Personally, I accept the minute extra wear, and consider the SSD as 'disposable'. Just like a spinner! I write them off in a few years, and after that I retire them to light duty in other machines. Or as reserve parts. I rather use the drive and gain the benefit of it's speediness. Otherwise: why buy an SSD?

[DavidR]

I too don't make any consideration on modern SSD drives other than don't defragment them.  They are capable of massive numbers of writes and the firmware does balances these writes over the SSD.

My SSD on my win10 laptop is 256GB and only 43GB in use, no danger of me running out of space or getting close to any write limits.  In normal use people shouldn't have much to worry about.

[REDACTED]

In Settings > Components > File Shield > Customize > Advanced I found two options I retyped below:

Use transient caching - By selecting this option, if a file is scanned and no thread is detected, this information will be stored in the temporary memory. The file will not be scanned again until either the system is restarted or the virus definitions are updated.

Does "temporary memory" mean RAM indeed or is this stored somewhere on the disk?

Use persistent caching - If this option is selected, files that are verified as clean (e.g. files that contain a valid digital signature) will not be scanned again, even after a system restart or virus definitions update.

I suppose this is again some kind of cache - is this stored in temporary system folder?

Think of it this way: you could 'protect' your SSD by preventing most writes to it. By diverting them to a spinner. But that negates the whole point of having an SSD.

My main point of having SSD is to start/load applications/games faster, not really to use it as constant writting cache.
For any other documents, archives, saves etc. I use HDD.

My SSD on my win10 laptop is 256GB and only 43GB in use, no danger of me running out of space or getting close to any write limits.  In normal use people shouldn't have much to worry about.

Then, it seems, I am not the "normal user".
At this moment I have over 150GB+ of applications/games which I use very often.
From time to time I install another 50GB+ of files with data I need to use.

[Rundvleeskroket]

My point is that wear comes from writes, not reads. But, to noticeably wear the cells out to the point that performance diminishes or capacity starts falling, on a modern sizeable SSD with wear leveling, over provisioning, some extra hidden capacity to switch in for cells that have dropped beneath the set reliability threshold, TRIM, etc. you'd have to write petabytes upon petabytes of data to the thing. You are simply not going to be doing that outside very intensive use cases. Like some servers or decades of video editing.

So again: the drive will in all likelihood become obsolete in some way, long before the dreaded 'wear' will actually become a thing you need to be concerned about. This really is something that was relevant 10 years ago. Not so today.

That bit of data Avast writes to your SSD will not kill it. You certainly should do what you feel most comfortable with, but just know that sparing the drive those few writes isn't going to make a lick of difference either way.

[REDACTED]

My point is that wear comes from writes, not reads.

Yes, I know that. That was just my reply to your sentence that "preventing most writes to it (...) negates the whole point of having an SSD".

That bit of data Avast writes to your SSD will not kill it.

I know that as well. As you can read above I said: "I do not mind "normal" writing to SSD, but if some app is going to write "a lot" or "constantly" that is a good reason to move it to another drive."

So when I found references that Avast can "write a lot" I decided to investigate this "problem" a little deeper.

[REDACTED]

After more reading about transient and persistent caching:

Persistent caching

In general - I think I should not worry too much about it.
No, it does not use temporary system folders and it is stored on system drive (so on SSD in my case).
Following this topic Clearing the Persistent Cache?, persistent cache is stored somewhere in C:\ProgramData\ subfolder.

BUT it is also important that the only data that is stored here is connected to files which are:
- operating system files
- files signed by trusted publishers
- other files covered by the avast! whitelist

... so in the end there won't be *that many* of them.

Also this quote from Avast Global Moderator:

The persistent cache is indeed stored in the db*.dat files (there's one file per volume).
Typically, they shouldn't be bigger than a few hundred KBs.

Transient caching

This is "another cup of tea". I still have not found where it is stored - is it really stored only in RAM or, again, in some folder?

According to its description it stores data connected to all scanned files and it's renewed every time when PC is restarted or when a new virus definitions database is installed.

So, for example, if I have a very big archive (10s of GBs) with very big amount of small files then all data connected to all these files could be added daily to transient cache and that can cause "a lot of writes" to my SSD (if this cache is indeed located here and not in temporaty directory nor in RAM).

[RejZoR]

SSD write durability is an irrelevant thing these days. Even crappiest SSD drives can survive for years of same usage as HDD's.

[REDACTED]

SSD write durability is an irrelevant thing these days. Even crappiest SSD drives can survive for years of same usage as HDD's.

Yes, I know, but that doesn't change the situation that I would prefer to not have GBs of "unnecessary" SSD writes daily if there is some simple solution to redirect them to my HDD.

[Rundvleeskroket]

You'll be doing it just because you can then, and not because it will have any meaningful beneficial effect. In fact, any measurable effect will be hurtful to performance. Hmmmkay...

You do realize that HDD platters wear out too? And don't have wear leveling as such and so by default write to the same first available sectors every time? Sectors that can also only be written to a set amount of times before becoming unreliable? The HDD with all it's moving parts will probably break long before the SSD does. Price parity will also happen someday. So to what end are you redirecting these writes? Certainly not to save money, or to prolong the life of the SSD noticeably. Soooo???

Even those tens of gigabytes daily you theorize about amount to very little in terms of wear. Again: the HDD will fare worse over time. But hey, tinker away I guess.

The only reason I still have a spinner in my system is because I'm not willing to shell out the cash for 4TB of SSD right now. I downgraded to a slower rpm drive for mass storage, and it still is the loudest thing in my build.