Creating a quarantined file recovery task

If you believe that a previously isolated file is safe, you can restore it from quarantine to the host.

To create a task for restoring a file from quarantine:

1. Select the Tasks section in the application web interface window.

   This opens the task table.

2. Click Add and select Restore file from quarantine.

   This opens the task creation window.

3. Configure the following settings:
   1. Description is the task description. This field is optional.
   2. File search—Name of the file in quarantine.
4. Click Add.

The task for restoring a file from quarantine is created. The task runs automatically after it is created.

After restoring a file from quarantine to a host, metadata about the file remains in the table of objects placed in Storage.

In distributed solution and multitenancy mode, a file that is quarantined on an SCN server cannot be restored on the PCN server. You can restore the file on the SCN server on which the quarantine file task was created.

Users with the Security auditor role cannot create tasks to restore files from quarantine.

Users with the Security officer role do not have access to tasks.

See also Managing tasks Viewing the task table Viewing information about a task Creating a get file task Creating a forensic collection task Creating a registry key retrieval task Creating an NTFS metafile retrieval task Creating a process memory dump retrieval task Creating a disk image retrieval task Creating a RAM dump retrieval task Creating a process termination task Creating a task to scan hosts using YARA rules Creating a service management task Creating an application execution task Creating a file deletion task Creating a file quarantine task Creating a copy of a task Deleting tasks Filtering tasks by creation time Filtering tasks by type Filtering tasks by name Filtering tasks by file name and path Filtering tasks by description Filtering tasks by server name Filtering tasks based on the name of the user that created the task Filtering tasks by processing status Clearing a task filter

Page top