Well, it's not 'scanning files'. It's scanning meta-data about directories and files.
You can see three calls for each file in the ProcMon logs:
1. CreateFile
2. QueryBasicInformationFile
3. CloseFile
Let's go through these in order:
1. Opens a handle to the file, allowing the application to query meta information, read, and write
2. Queries meta information about the file.
3. Closes the handle to the file before doing anything else, including reading data.
There's no scanning of files, because no data is read. Its common for applications to traverse directories like this, and the behavior could even be a consequence of a file system library or API that dropbox is using. If you think of your file system as a filing cabinet, what DropBox is doing might be equivalent to opening every drawer looking for a single file.
ProcMon detects CreateFile and QueryInformationFile using these function codes:
As you can see, neither of these indicates a file being read. It also monitors a number of other codes (I'm not sure how specifically it detects CloseFile), including this one, which is triggered when data is read from a file:
You can see three calls for each file in the ProcMon logs:
1. CreateFile
2. QueryBasicInformationFile
3. CloseFile
Let's go through these in order:
1. Opens a handle to the file, allowing the application to query meta information, read, and write
2. Queries meta information about the file.
3. Closes the handle to the file before doing anything else, including reading data.
There's no scanning of files, because no data is read. Its common for applications to traverse directories like this, and the behavior could even be a consequence of a file system library or API that dropbox is using. If you think of your file system as a filing cabinet, what DropBox is doing might be equivalent to opening every drawer looking for a single file.
ProcMon detects CreateFile and QueryInformationFile using these function codes:
https://msdn.microsoft.com/en-us/library/ff548630(v=vs.85).a...
https://msdn.microsoft.com/en-us/library/ff549283.aspx
As you can see, neither of these indicates a file being read. It also monitors a number of other codes (I'm not sure how specifically it detects CloseFile), including this one, which is triggered when data is read from a file:
https://msdn.microsoft.com/en-us/library/ff549327(v=vs.85).a...
If that was being called, ProcMon would show it, but it doesn't