Helpers
Quarantine & Recovery
Quarantine and recovery are designed as a controlled lifecycle. The point is not only to hide a file, but to give operators a safe place to make later trust decisions.
Last updated: April 15, 2026
What quarantine preserves
Original file path, detection reason, parent process context, hash, operator decisions, and timestamped actions all stay associated with the artifact.
When recovery is appropriate
Restore is appropriate after validation, not as a reflex. The platform is designed to keep enough information attached to each artifact so a restore decision is reviewable later.