Purpose of Knowledge Article:

• A guide on how to recover false-positive files quarantined by CrowdStrike Falcon
• This is for false-positive quarantine files

Resolution:

• The user has Quarantined files are automatically deleted 30 days before the quarantined files are automatically deleted to after the date of quarantine. Once deleted, they cannot be recovered
• Users must request a restore of any quarantined files at least 5 days before the automatic deletion date in order to facilitate a successful recovery

Request to restore quarantined files:

• Submit a request to [email protected] and include the following information:
  • DOE number of the computer
  • Computer name
  • Name of the file
  • Date of when the file was quarantined
  • Berkeley Lab username and employee ID number