When Malware Scanning detects malware, Files.com moves the file out of the folder it was uploaded to and into quarantine, keeping its original path underneath so an administrator can identify where it entered the site. A file uploaded to /Finance/Invoices/march.zip moves to _/Quarantine/Finance/Invoices/march.zip. If a file with that same original path is quarantined again, Files.com adds a numeric suffix to the second one.

Quarantine is a folder inside your site's underscore folder at a fixed location you cannot change. Only Site Administrators can open it, and that access cannot be granted to anyone else. You cannot configure Folder Settings or Notifications beneath it, and no Sync or Automation can write into it.

Quarantined files use native Files.com storage in your site's default storage region. They do not retain the upload folder's regional storage setting, and you cannot configure a separate region for quarantine. Include this storage location when evaluating Malware Scanning against your organization's data-residency requirements.

Files.com stops the original folder's remaining upload processing. If the upload was destined for a Remote Server Mount, Files.com cancels that delivery. This keeps the detected file out of the workflow that would otherwise use or distribute it.

The uploader gets no error when Files.com quarantines a file. No notification or webhook fires, no event is recorded, and no scan result is available anywhere.

Quarantined files are kept indefinitely to preserve evidence for an administrator's investigation, and continue to count toward your storage usage. There is no way to release a file from quarantine, and no way to delete one.

Retrieving a Quarantined File

Site Administrators can download a quarantined file directly from the folder.

To get a copy somewhere else, use a Sync with Malware Quarantine as the source location, which appears once your site has quarantined files. It opens a read-only file view that starts at the quarantine folder.

Use it to send a copy to a security team for analysis, preserve one as evidence, or recover a false positive.

Archive Removed Files does not capture an infected file, so quarantine is the only place you will find it.