Quarantine: what happens to your file

The steps, in order

1. 1

   Step 1

   On detection the file is moved to data/quarantine/ and encrypted with a key derived from the SHA-256 of its content, a random 12-byte IV and a 16-byte tag.

2. 2

   Step 2

   Metadata (original path, hashes, detections) stays in SQLite. The original file is deleted from disk, not just renamed.

3. 3

   Step 3

   Restore verifies the GCM tag before writing anything. If the blob was modified, the operation is refused, not “almost successful”.

4. 4

   Step 4

   The legacy DQ1 (XOR) format is still readable, so older installations do not end up with inaccessible files.