Purpose of Knowledge Article:

• A guide on how to recover false-positive files quarantined by CrowdStrike Falcon

Resolution:

• Quarantine files are automatically deleted after 30 days. Once deleted, it can not be recovered
• Users must request a restore of quarantined files before it is automatically deleted

Request to restore quarantined files:

• Submit a request to [email protected] and include the following information:
  • DOE number of the computer
  • Computer name
  • Name of the file
  • Date of when the file was quarantined
  • Berkeley Lab username and employee ID number