Scanning is disclosed. A scan collection period is determined. A system is monitored to detect object events during the scan collection period, and differential and incremental scan lists may be updated with information regarding objects to be scanned, based on some of the object events. Objects are scanned based on the information in the incremental scan list. Objects are scanned based on the information in the differential scan list. The incremental scan may be performed more than once before the differential scan is performed. Information regarding objects associated with object events occurring outside the scan collection period may be removed from the scan list.