When Malware Scanning finds a threat, Files.com moves the file out of the folder it was uploaded to and into quarantine, keeping its original path underneath. A file uploaded to /Finance/Invoices/march.zip moves to _/Quarantine/Finance/Invoices/march.zip. If a file with that same original path is quarantined again, Files.com adds a numeric suffix to the second one.

Quarantine sits in your site's underscore folder at a fixed location you cannot change. Only Site Administrators can reach it, and that access cannot be granted to anyone else. You cannot configure Folder Settings or Notifications beneath it, and no Sync or Automation can write into it.

Files.com doesn't tell anyone when it catches a file. The uploader gets no error, no notification or webhook fires, no event is recorded, and no scan result is available anywhere. From their point of view, the file simply stops being where they uploaded it.

The silence is deliberate, because telling a sender their upload was caught tells an attacker what to change.

There is no way to release a file from quarantine, and no way to delete one. Not even our Support Team can do it. Quarantined files are kept indefinitely and continue to count toward your storage usage.

Getting a Copy Out

Site Administrators can download a quarantined file directly from the folder.

To get a copy somewhere else, use a Sync with Malware Quarantine as the source location, which appears once your site has quarantined files. It opens a read-only file view that starts at the quarantine folder.

That is how you get a copy of a quarantined file to a security team for analysis, preserve it as evidence, or recover a legitimate file caught by mistake.

Archive Removed Files does not capture an infected file, so quarantine is the only place you will find it.