When Malware Scanning detects malware, Files.com moves the file out of the folder it was uploaded to and into quarantine, keeping its original path underneath so an administrator can identify where it entered the site. A file uploaded to /Finance/Invoices/march.zip moves to _/Quarantine/Finance/Invoices/march.zip. If a file with that same original path is quarantined again, Files.com adds a numeric suffix to the second one.

Quarantine is a folder inside your site's underscore folder at a fixed location you cannot change. Only Site Administrators can open it, and that access cannot be granted to anyone else. You cannot configure Folder Settings or Notifications beneath it, and no Sync or Automation can write into it.

A quarantined file stays in the storage region where Files.com held its upload for scanning. For an upload to native Files.com storage, that is the upload folder's region. An upload to a Remote Server Mount is buffered in USA (Virginia), so a file quarantined from a mount stays there. Moving a file into quarantine does not move it to another region, and you cannot configure a separate region for quarantine. Include these locations when evaluating Malware Scanning against your organization's data-residency requirements.

To confirm where a quarantined file is stored, open _/Quarantine and select the file. Its details show the geographic region under Storage Location. The file list's Region column shows the same region for each file.

Files.com stops the original folder's remaining upload processing. If the upload was destined for a Remote Server Mount, Files.com cancels that delivery. This keeps the detected file out of the workflow that would otherwise use or distribute it.

Quarantined files are kept indefinitely to preserve evidence for an administrator's investigation, and continue to count toward your storage usage. There is no way to release a file from quarantine, and no way to delete one.

Quarantine Alerts

The uploader gets no error when Files.com quarantines a file, so the team responsible for the workflow needs a separate alert. Each completed quarantine produces an Event Channels event with Error severity, the original file path, and the actual quarantine path, including any numeric suffix.

An enabled subscription routes matching quarantine events to one or more enabled targets. Email, Slack, and Teams targets notify people; webhook, SNS, Pub/Sub, and Folder targets deliver events to other systems.

The subscription's Channel must also be enabled. Existing subscriptions that match all event types also match quarantines, subject to their filters and Workspace scope.

The event belongs to the file's original Workspace, even though quarantine is site-wide. To receive alerts from every Workspace at a central destination in the Default Workspace, enable Apply to All Workspaces on both the subscription and the target. Workspace scope determines which other subscription and target combinations can deliver an event.

The original path identifies the interrupted workflow, and the quarantine path locates the stored file. Receiving an alert does not grant access to quarantine; a Site Administrator must retrieve the file when further review is needed.

Check Events for the quarantine record and Delivery Attempts for each target's delivery result. If the event exists but no delivery is recorded, check that the Channel, subscription, and target are enabled, that the event matches the subscription's types and filters, and that both subscription and target allow its Workspace. A successful delivery does not establish that someone reviewed the file.

Quarantine events do not require the site's File Activity Events setting to be enabled. Only completed quarantines produce them; clean scans and files the scanner cannot inspect do not. Scan failures are recorded on the Pending Work log.

Event records are retained for 30 days, independently of the quarantined files' indefinite retention.

Retrieving a Quarantined File

Site Administrators can download a quarantined file directly from the folder.

To get a copy somewhere else, use a Sync with Malware Quarantine as the source location, which appears once your site has quarantined files. It opens a read-only file view that starts at the quarantine folder.

Use it to send a copy to a security team for analysis, preserve one as evidence, or recover a false positive.

Archive Removed Files does not capture an infected file, so quarantine is the only place you will find it.