Quarantine

The main function of the quarantine is to safely store infected files. Files should be quarantined if they cannot be cleaned, if it is not safe or advisable to delete them, or if they are falsely detected by ESET File Security for Linux. You can choose to quarantine any file. This is advisable if a file behaves suspiciously but is not detected by the antivirus scanner. Quarantined files can be submitted for analysis to the ESET Virus Lab.

Manage quarantined items through the Web interface

The Quarantine screen displays a list of files stored in the quarantine folder. The list displays: the date and time of quarantine, the path to the original location of the quarantined file, reason of moving the file to quarantine, number of threats (for example, if it is an archive containing multiple infiltrations), and size of quarantined item.

Click the quarantined item to display the available actions: Restore, Restore and Exclude, Copy path, Download, Delete from quarantine.

The Restore and Exclude option is displayed only for items the detection engine evaluated as eligible for exclusion

Path to quarantine directory: /var/opt/eset/efs/cache/quarantine/root/

Manage quarantined items via Terminal

Syntax: /opt/eset/efs/bin/quar [OPTIONS]

Options - short form

Options - long form

Description

-i

--import

Import file to quarantine

-l

--list

Display list of files in quarantine

-r

--restore=id

Restore quarantined item identified by id to path defined by --restore-path

-e

--restore-exclude=id

Restore quarantined item identified by id and marked by 'x' in the excludable column

-d

--delete=id

Delete quarantined item identified by id

-f

--follow

Wait for new items and append them to the output

 

--restore-path=path

New path to restore a quarantined item to

-h

--help

Show help and quit.

-v

--version

Show version information and quit

Example

Delete a quarantined item with id "0123456789":

/opt/eset/efs/bin/quar -d 0123456789

or

/opt/eset/efs/bin/quar --delete=0123456789

 

Restore a quarantined item with id "9876543210" to the Download folder of the logged in user and rename it to restoredFile.test :

/opt/eset/efs/bin/quar -r 9876543210 --restore-path=/home/$USER/Download/restoredFile.test

or

/opt/eset/efs/bin/quar --restore=9876543210 --restore-path=/home/$USER/Download/restoredFile.test

 

Restore a quarantined item with id "123456789" which is marked "x" in the excludable column to the Download folder:

/opt/eset/efs/bin/quar -e 9876543210 --restore-path=/home/$USER/Download/

or

/opt/eset/efs/bin/quar --restore-exclude=9876543210 --restore-path=/home/$USER/Download/

Restore file from quarantine via Terminal

1.List quarantined items.
/opt/eset/efs/bin/quar -l

2.Look up the ID and name of the quarantined object you want to restore and run the following command:
/opt/eset/efs/bin/quar --restore=ID_OF_OBJECT_TO_RESTORE --restore-path=/final/path/of/restored/file