Technical
documentation.

What the command line accepts today, what each output means and where the program stores what it stores.

Commands and options

What the command line accepts today. No promise of commands that don't exist.

Quick reference
Command or option	What it does
`scan <path>`	Scans a folder or a file. Accepts `--report-html`, `--report-json`, `--max-size` and `--quarantine-suspicious`.
`restore <id>`	Returns a quarantine item to its original path, checking the SHA-256 first.
`update-signatures <file>`	Imports a list of hashes or snippets into the user's base.
`--rules <folder>`	Points to the YARA rules folder, when the optional package is installed.
`--max-size <MiB>`	Per-file limit. The default is 2048 MiB; above that the file is logged as skipped.
`--quarantine-suspicious`	Does what the name says: also isolates what is merely suspicious.

Real detection depends on what you import. These are the accepted formats.

Plain text (.txt)

One SHA-256 per line. It's the simplest format to generate from any spreadsheet.
MalwareBazaar CSV

Direct export from the service. The hashes are CC0, which avoids licensing problems on redistribution.
JSON in the program's format

Accepts hashes and snippets. Useful when you want to version the base along with other configuration.
Snippets of 16 to 256 bytes

Up to 5,000 patterns per base. Each pattern costs one search per block; for large lists, prefer hashes.

So automation doesn't confuse "clean" with "didn't finish", each outcome has its own code.

Scan output
Outcome	Meaning
Clean	The scan finished and found nothing.
Found	Finished and found at least one malicious or suspicious item.
Incomplete	Did not finish: unreadable file, rule timed out or interruption. Never treat as clean.

All on your computer, in the app's data folder.

Signature base

Imported hashes and snippets stay in the signatures folder, versioned along with the program when you want.
Quarantine

.qbr items with a manifest. The key sits in the manifest: whoever uses your account can read it.
History and reports

Reports only when you ask. They contain file paths, which may identify you.

See the prices and start with the product that's right for you.