Safety & privacy
Updated August 12, 2026 · min read
Can OneDrive Be Scanned Without Downloading Your Files?
Learn what a metadata-only scan can detect, where it stops, and how to verify the claim.
A full content download is unnecessary when the goal is to identify exact copies and OneDrive already provides a usable content-derived fingerprint. Avoiding the transfer saves bandwidth, local space, and an extra exposure path.
The scanner enumerates drive items, handles pagination, groups equal byte sizes, and compares quickXorHash values from the hashes facet. It should clearly label items whose hash is missing instead of falling back to names as proof.
A practical checklist
- 1Confirm the scanner uses Microsoft OAuth.
- 2Read its statement about file-body and thumbnail processing.
- 3Check that the scan requests read-only scope.
- 4Verify the exact-match rule and missing-hash behavior.
- 5Use the export before considering any separate write step.
Understand the situation
A full content download is unnecessary when the goal is to identify exact copies and OneDrive already provides a usable content-derived fingerprint. Avoiding the transfer saves bandwidth, local space, and an extra exposure path.
A permission label describes technical access, not the provider’s entire security posture. Review the exact scope, token handling, retention, operator access, and purpose of every data field before connecting an account.
Use a controlled workflow
The scanner enumerates drive items, handles pagination, groups equal byte sizes, and compares quickXorHash values from the hashes facet. It should clearly label items whose hash is missing instead of falling back to names as proof.
Use least privilege in stages: read-only access for inventory and review, followed by separate write consent only if the user chooses an approved cleanup. A report-only workflow should remain possible.
- Read its statement about file-body and thumbnail processing.
- Check that the scan requests read-only scope.
- Verify the exact-match rule and missing-hash behavior.
Make the final decision
Use metadata-only scanning when exact duplicates answer the problem. Choose a content-processing tool only when the additional goal—such as similar photos—is worth the broader data access and handling.
Metadata is not harmless just because it excludes file bodies. Names, paths, sizes, account IDs, and sharing state can reveal sensitive business or personal context and need deliberate protection.
Limits and risks to check
- — Metadata-only does not mean data-free.
- — Unsupported hashes leave some items unresolved.
- — Content similarity is outside the method.
- — An implementation could make extra requests beyond its stated design, so review trust controls.
Official references
Frequently asked questions
Does quickXorHash require downloading the file?
OneDrive can return it in file metadata for supported items, allowing the scanner to compare the value without fetching the body.
Can this find resized photos?
No. Resizing changes bytes, so it is not an exact duplicate.
What if a hash is missing?
The item should remain unresolved or require another comparison method, not be promoted from a name or size match.
Scan first. Decide with evidence.
ClearCopies reads supported cloud-drive metadata and groups exact copies by byte size plus a provider-supplied content fingerprint. Original file bodies are not downloaded for the scan. You review the result and export a plan before any separate write step.