Application data storage

After Kaspersky Rescue Tool finishes, some files that the application needs to work are saved on the computer. By default, the application saves files in the following directory:

• /home/krd/Desktop/Product Folder on Kaspersky Rescue Disk.
• C:\KRD2024_Data in Windows.

If the main partition does not have enough space, Kaspersky Rescue Disk creates a directory on another partition that has 1 GB free.

If the hard disk has less than 1 GB free, Kaspersky Rescue Tool creates a directory in RAM. After restarting the computer, the operating system deletes files from the directory.

The user is responsible for ensuring the security and controlling and restricting access to the information that is stored on the computer.

The directory of the application contains the following subdirectories and files:

• The Bases directory contains anti-virus databases downloaded from Kaspersky servers. The files have the SRM format.
• The Quarantine directory contains quarantined files.

  Files can contain the following user data:

  • Object name
  • File location
  • Name of the user that ran the application

  Files are stored in an encrypted form. File names have the kvt*.klq format.

• The Report directory contains application performance report files.

  Files can contain the following user data:

  • Locations of scanned files
  • Registry keys that have been modified by the application
  • Web page addresses that were found in scanned objects
  • Windows user name.

  Files are stored in an encrypted form. Standard report file names have the report_<date>_*.klr.enc1 format.

• The Traces directory contains trace and dump files.

  Trace files can contain the following general data:

  • Event time
  • Number of the execution thread
  • Application component that caused the event
  • Event severity (information, warning, critical, error)
  • A description of the application component command execution event and the result of the command

  In addition to general data, trace files may contain user data:

  • Personal information including the full name of the individual if such information is part of a path to a file on the computer
  • User account name if the user account name is part of a file name
  • Email address or web address containing a user account name and password if these are part of the name of a detected object
  • Remote IP addresses with which the computer established connections
  • Web addresses that are part of names of scanned objects

  If the application uses a proxy server, the trace files may contain the following data:

  • Proxy server address
  • Computer name
  • IP address and port of the computer
  • User name used to authorize at the proxy server

  Files are stored in an encrypted form. Trace files names follow the KRT.<date>.log.enc1 format.

• Dumps. Dumps store information about the working memory of processes at the moment the process crashes, and they may also contain personal information.

  Files are stored in an encrypted form. Dump file names follow the *.dmp.enc1 format.

• Hardware information.

  Files are stored as plain text. File names with hardware information follow the krd2024_hwinfo_<random character sequence>.tgz format.

Page top