Hi, I have found that when rootcheck scanning is running the realtime monitoring notification are delayed until the scanning is finished. This may lead to wrong assumptions when the time of the modification of a file is considered in a analysis. I think this should be documented somewhere until this has been fixed.
Cheers, --Marco
