Should I Delete Quarantined Files? What Quarantine Actually Does to Them

Your scanner found something, you clicked the button, and now there is a list of quarantined items sitting there. The obvious next instinct is to empty it. Before you do, it is worth knowing what quarantine already did, because it changes the answer.

Quarantine is not a folder your file was moved to

It is closer to a sealed box than a drawer. On Windows, Microsoft Defender keeps quarantined items under ProgramData\Microsoft\Windows Defender\Quarantine, split into two parts: Entries, which holds the metadata about when and why something was quarantined, and ResourceData, which holds the contents of the file itself.

Both parts are encrypted with RC4. That is why you cannot browse to the folder and open what is inside, and why the file can no longer run, be opened by another program, or be picked up by a scheduled task. It has been taken out of circulation.

The detail that stops “encrypted” from meaning “safe”

Here is the part most articles leave out. Forensic researchers who reverse-engineered the format found that the RC4 key is hardcoded in mpengine.dll. It is the same key everywhere, and it is publicly known.

That is not a scandal, because it was never meant to be a secret. Quarantine exists to make a file inert, not to make it confidential. But it does set the limit honestly: a quarantined file is safe from being executed by accident, and it is not a vault. Anyone with access to the machine and the published format can reconstruct the original.

So should you delete them?

For most people, most of the time: there is no urgency, and no strong reason to. The file is already neutralised. Deleting it does not make you safer than quarantine already did; it only makes the action permanent.

What deleting does change is your ability to undo a mistake. Scanners produce false positives, and they land hardest on the things people cannot easily replace: a niche utility, a game modification, a keygen-adjacent tool from a legitimate installer, a script someone wrote themselves. If that file is deleted rather than quarantined, it is gone.

Three cases where deleting is reasonable:

You have positively identified the file and it is genuinely malicious. Not “the scanner said so” - you looked at where it came from and it does not belong there.

Disk space genuinely matters. Quarantine stores the full contents, so a large detected file occupies its full size twice over until purged.

Policy requires it. In a managed environment, this is not your call.

And the case where deleting is a mistake: you are not sure, and the file is something you cannot download again. Leave it. It is doing nothing where it is.

Do not count on automatic cleanup

You will read that quarantined items disappear after thirty days. Microsoft’s own documentation on restoring quarantined files does not state a retention period, and the purge behaviour is configurable. Treat automatic removal as something that may happen, not as a guarantee you can plan around in either direction. If you want an item gone, remove it deliberately.

How to get a file back, if you decide it was a false positive

Through the interface: open Windows Security, go to Virus & threat protection, then Protection history under Current threats, filter on Quarantined Items, select the item and choose Restore.

From the command line, in an elevated prompt, MpCmdRun.exe -Restore -ListAll shows everything currently quarantined, and MpCmdRun.exe -Restore -Name <filename> restores a specific one.

If you restore something the scanner still considers malicious, expect it to be caught again. Restoring is not the same as trusting; you may also need an exclusion, and an exclusion is a decision you should be able to justify.

The short version

Quarantine already did the important part: the file is encrypted, inert, and cannot execute. Deleting it adds no protection and removes your ability to reverse a false positive. Delete when you are sure or when space demands it, keep when you are not, and do not rely on the folder cleaning itself.

The quarantine paths and the split between Entries and ResourceData, the RC4 encryption and the hardcoded key in mpengine.dll, come from published forensic research into the Windows Defender quarantine format. The restore procedures through Windows Security and MpCmdRun are from Microsoft’s own documentation, checked at the time of writing; that page states no retention period. Verify against current vendor documentation before relying on a specific detail. Commercial links carry the rel=“sponsored nofollow” attribute; an affiliate commission may apply at no extra cost to you.