When submitting a virus false positive report, preemptively gathering data to attach to the case will result in a quicker turnaround time.
Collecting a full sample to submit is useful for analysis, as it is fully possible an antivirus signature can trigger for a similarly structured sample as the one that it was initially generated to prevent against; this is to help protect against polymorphic malware.
In order to capture the full file, it is required to determine where it is coming from.
Consider a few questions when attempting to capture the file:
After all of this data has been gathered and placed in the support case, the sample can be analyzed and a verdict can be reached.