I know that the VRDB collects information on changes that are made to files, to aid in repairing infected ones. I know that by default it updates the database every 3 weeks, and that it monitors files three versions back.
However, I cannot find any info on which files the VRDB looks at!
I mean - it’s storing executable files only.
I’m not completely sure if it’s really all of them, or just those with common extensions (exe, dll, etc.) - I’d have to check the source code thoroughly.
And yes, the files are scanned before creating/updating their VRDB records.