Purpose of Knowledge Article:

• A guide on how to recover false-positive files quarantined by CrowdStrike Falcon

Resolution:

• Quarantined files are automatically deleted 30 days after the date of quarantine. Once deleted, they cannot be recovered
• Users must request a restore of quarantined files at least 5 days before the automatic deletion date in order to facilitate a successful recovery

Request to restore quarantined files:

• Submit a request to [email protected] and include the following information:
  • DOE number of the computer
  • Computer name
  • Name of the file
  • Date of when the file was quarantined
  • Berkeley Lab username and employee ID number