1. A method comprising: querying a security subsystem to trustfully determine whether an area of a storage device has been written to since a last scan, wherein the security subsystem includes a trusted variable and wherein the determination avails trust through a reference to the trusted variable by the security subsystem; and scanning the area for an identifier of undesirable code in response to a trusted determination from said query that the area has been written to since the last scan.