Force or Skip a Backscan

When a Stairwell forwarder is installed, it performs a backscan -- a full scan of every file on every volume of the asset. This ensures complete visibility from day one. There are situations where you may want to force a backscan to run again or skip the initial backscan entirely.

Force a Backscan

When to use: After policy changes, after a previously skipped backscan, or to ensure complete file coverage on an asset.

Forcing a backscan clears any stored scan-progress state and restarts the full-volume scan from scratch. Steps vary by operating system.

Windows

1. Download and run the backscan reset script as an Administrator. The script handles both legacy (InceptionForwarder) and modern (StairwellForwarder) service names automatically.

# Run as Administrator
# The script will:
#   - Stop the forwarder service
#   - Clear backscan registry values under HKLM:\Software\Stairwell\
#   - Re-enable the full volume scan flag
#   - Restart the forwarder service
.\restart_backscan.ps1

Contact Stairwell Support to obtain the latest version of restart_backscan.ps1.

Linux

1. Stop the Stairwell service.
2. Remove the scan-session state file.
3. Start the Stairwell service.

sudo systemctl stop stairwell
sudo rm /var/lib/stairwell/scansession.json
sudo systemctl start stairwell

macOS

1. Delete the backscan keychain entries.
2. Reload the forwarder extension.

sudo security delete-generic-password -a FullDiskScanState
sudo security delete-generic-password -a FullScanStatus
sudo /Applications/Inception\ Forwarder.app/Contents/MacOS/Inception\ Forwarder uninstall-extension
sudo /Applications/Inception\ Forwarder.app/Contents/MacOS/Inception\ Forwarder install-extension

Skip a Backscan

When to use: To speed up initial deployment or asset re-registration when you only need forward-looking file visibility.

Important: If you skip the initial backscan, files will only appear in Stairwell as they are written, modified, or executed going forward. Pre-existing files will not be inventoried until a backscan is triggered.

Windows -- UI Installation

1. During installation, uncheck the Perform Initial Scan checkbox.

Windows -- Command-Line Installation

1. Pass the DOSCAN=0 flag during the silent install.

.\InceptionForwarderBundle.exe TOKEN="<AUTH_TOKEN>" ENVIRONMENT_ID="<ENV_ID>" DOSCAN=0 /quiet /norestart /log C:\stairwell.log

Linux and macOS

Skipping the initial backscan on Linux and macOS requires a configuration change before the first service start. Contact Stairwell Support for platform-specific instructions.