Quarantining files about 300 MB / Hunting big Files

[RFeyertag]

Hello dear community, 

what happens with quarantined files, which have 300 MB? 

I can't download it from the action center like I am used to. 

Yes, I saw they are moved to %PROGRAMDATA%\Cyvera\Quarantine), but can I get it from there?

Would you hunt big files, which are executed by users? 

BR

Rob

[jmazzeo]

Hi @RFeyertag, thanks for contacting us in the Live Community.

I'll do some checks and I'll be back with more information about retrieving files from quarantine (without restoring them).

Is really hard to find a 300MB malware file, maybe a zipped one containing it. Is a size that is really hard to manage on any solution.

[jmazzeo]

@RFeyertag, I did some tests, and the files retrieved from the Qarantine folder, comes encrypted with a .qtn extension.

The option that comes to my mind, is:

- Restore the file to the original location.

- Retrieve it using the Action Center as you usually do.

The max size of the files is 500MB.

Please, le me know if it works for you, and mark the answer as the solution.

Thanks!

[RFeyertag]

Thank you so much for your attention to this question. 

In my mind I was able to get the file from quarantine. But I think in this case it is too big or the isolated endpoint didn't allow it. Maybe the client also wasn't online anymore. 

So, if I retreive files from quarantaine, the client needs to be online, right? 

I will try your suggestion, thank you! 

BR

Rob

[jmazzeo · Accepted solution]

Yes, if you need the files at the moment, it needs to be online. If it is not, the task is hold as "Pending" until the client connects again with the console.

I tried to retrieve files with the route %PROGRAMDATA%\Cyvera\QuarantineV2\*.* and all came encrypted.

Thanks!

JM