Scanning Donated Devices with ClamAV

Nonprofits live on donated hardware. Laptops from corporate refreshes, desktops from school upgrades, and thumb drives from well-meaning supporters arrive by the boxful. Every one of them is a potential trojan horse. Corporate machines may carry dormant malware. Personal USB sticks often harbor autorun worms. Before any donated device joins your network or gets handed to a participant, it needs a clean bill of health. ClamAV on a Raspberry Pi provides that screening for zero marginal cost per scan.

Why Linux Needs Antivirus Too

It is a myth that Linux is immune to malware. While Linux desktops are less commonly targeted than Windows, they are not invulnerable—and they make excellent carriers. A Pi running a file server or Nextcloud instance can store infected documents that propagate to Windows clients. A Linux NAS can host ransomware that encrypts every connected share.

More importantly, donated machines are rarely wiped properly. A corporate "decommissioning" process may leave user profiles, browser histories, and dormant executables intact. ClamAV catches these remnants before they reach your participants or your staff.

What You Need

• Raspberry Pi 3 or newer
• Raspberry Pi OS or Ubuntu Server
• A USB dock or adapter for connecting donated hard drives (SATA-to-USB (an adapter that lets you connect a desktop hard drive to a USB port) or NVMe enclosure)
• Patience: thorough scans take time, especially on spinning drives

Installation

Install ClamAV and its fresh signature updater:

sudo apt update
sudo apt install clamav clamav-daemon

Update the virus definitions before your first scan:

sudo freshclam

If freshclam fails because the daemon is already holding the database lock, stop the daemon temporarily:

sudo systemctl stop clamav-freshclam
sudo freshclam
sudo systemctl start clamav-freshclam

Scanning a Donated Hard Drive

Connect the donated drive via USB. Identify its mount point:

lsblk

Look for a partition such as /dev/sda1 mounted under /media/pi/ or /mnt/. Run a recursive scan:

sudo clamscan -r --infected --log=/var/log/clamav-donation-scan.log /media/pi/DONATED_DRIVE

Flags explained:

• -r : recursive scan of all subdirectories
• --infected : only list infected files (quieter output)
• --log= : write full results to a dated log

If infected files are found, ClamAV reports them but does not delete them. Decide per file:

• Quarantine: Move to an encrypted offline storage for analysis
• Delete: If the file is clearly malware and not recoverable data
• Clean: Rarely possible; most malware is not cleanly repairable

Automated Scanning for Shared Folders

If your Pi runs a Samba or NFS share for staff and participants, schedule nightly scans:

sudo mkdir -p /var/log/clamav
sudo crontab -e

Add this line for a 2 AM scan of /srv/shares:

0 2 * * * clamscan -r --infected --log=/var/log/clamav/nightly-$(date +\%Y\%m\%d).log /srv/shares

Keep fourteen days of logs, then rotate:

sudo apt install logrotate

Create /etc/logrotate.d/clamav-custom:

/var/log/clamav/*.log {
    daily
    rotate 14
    compress
    missingok
}

Scanning Before Handoff

Create a written protocol for hardware donations. Tape it to the Pi or the scanning station:

1. Receive: Log the donor, date, and serial number in a paper ledger.
2. Isolate: Do not connect the device to the main network. Use a dedicated VLAN (a way to divide a physical network into isolated segments without extra hardware) or an air-gapped Pi.
3. Image: If possible, clone the drive before scanning. Tools like dd or Clonezilla preserve evidence.
4. Scan: Run ClamAV. Note any detections in the ledger.
5. Wipe: Regardless of scan results, wipe the drive and reinstall the operating system. A clean install is the only guarantee.
6. Re-scan: Verify the wiped drive is clean.
7. Handoff: Document the recipient, date, and device ID.

ClamAV is a screening tool, not a guarantee. A clean scan does not mean a drive is safe; it means known malware signatures were not detected. Always pair scanning with a full operating system reinstall.

Training Volunteers

Malware identification is a teachable skill. Walk volunteers through these exercises:

• Read a ClamAV log and identify the file path, malware name, and engine version.
• Use ls -la to inspect file permissions and modification dates on flagged files.
• Practice mounting and unmounting USB drives safely to prevent filesystem corruption.
• Discuss social engineering: why a file named "URGENT_Invoice.pdf.exe" is suspicious even if ClamAV misses it.

The volunteer who masters this workflow becomes your organization's first line of defense against data breaches and ransomware.

Why This Matters for Nonprofits

A single infected laptop on a shared network can spread laterally in minutes, encrypting donor databases, participant records, and financial spreadsheets. Endpoint protection licenses for ten machines cost hundreds annually. ClamAV costs nothing. The Pi that runs it costs $75. The volunteer who learns to interpret scan logs gains a defensive skill that protects your mission every single day. In an ecosystem that depends on donated and reused technology, proactive hygiene is not optional—it is survival.