Quarantine

Security programs on computers and phones scan files for malware. Malware refers to programs that secretly steal data or render a computer unusable. When a security program finds something suspicious, it usually doesn’t delete the file right away. Instead, it moves it to a locked-down area, the quarantine. There, the file is packaged in such a way that it can no longer be started. The term originates from medicine: anyone who might be contagious is isolated first, not punished.

Why suspicious items aren’t deleted immediately

Security programs make mistakes on a regular basis. Such a mistake is called a false alarm, or false positive in English. A harmless file is wrongly classified as dangerous. This often affects self-written programs, game mods, or software from small vendors.

If the program deleted files immediately, such an error could no longer be undone. In the worst case, a system file would be missing afterward and the computer would no longer start. That is exactly what happened in 2010 with a faulty McAfee update: a harmless Windows file was removed worldwide, and thousands of company computers failed. Quarantine is the insurance against such accidents.

For experts, the quarantine folder has a second use as well. Security researchers can later examine the isolated file at their leisure and find out what it was actually trying to do. In the case of an attack on a company, this is often the most important clue. Deleted files, on the other hand, reveal nothing anymore.

What happens to the file when it is moved

The file is taken from its original location and copied into a special directory. In doing so, the security program deliberately alters the file. Often, all bytes are combined with a fixed pattern, making the content unreadable. The process is reversible, so the file can be restored.

In addition, the file loses its extension and its permissions. An executable file becomes a lump of data that the operating system can no longer launch. Even a double-click in the quarantine folder therefore triggers nothing. At the same time, the security program saves an entry with the location found, the time, and the name of the detected threat.

A common misunderstanding: quarantine is not a recycle bin. In the recycle bin, a file remains fully functional and can continue to cause harm. In quarantine, it is neutralized. Most programs automatically delete the content after a few weeks if no one intervenes.

From Windows Security to the spam folder

On private computers, quarantine is most commonly encountered in Windows Security or in programs like Avast, Bitdefender, or Malwarebytes. After a detection, a notification appears with three options: remove permanently, restore, or add an exception. An exception should only be set if you know exactly where the file came from.

Email systems in companies and schools also use the term. Suspicious messages end up there in a mail quarantine, not in the inbox. Many employees receive a summary of these withheld emails once a day and can release individual ones. The spam folder of a normal email account works on the same principle.

In business news, quarantine usually comes up when something has gone wrong. When an update from a security vendor suddenly isolates important programs, entire companies grind to a halt. Security software reaches deep into the system, which is why its errors carry serious weight. Quarantine limits the damage, but does not prevent it.