Using the Quarantine Extract tool

- About the Quarantine Extract tool

- Command-line options for the Quarantine Extract tool

- Legal notice

## About the Quarantine Extract tool

^Back to top

The Quarantine Extract command line tool extracts and restores files from the quarantine in the Symantec Endpoint Protection client. You might need this tool if the client quarantines a file that you determine is a false positive.

The tool uses the QEXTRACT command. The command includes different options to target a file or groups of files for restoration. The targeted file is always restored to the directory path from which it was initially quarantined.

You can quickly restore files from the Quarantine across your network. To run the tool on multiple client computers, you can use a login script or a third-party application. Typically, you use the /FILE and /RISK options for restoration across a network.

## Command-line options for the Quarantine Extract tool

^Back to top

The Quarantine Extract tool uses the QEXTRACT command with various options to extract and restore a file or a group of files onto client computers. You can also use the tool to get information about the files that are contained in the Quarantine of the Symantec Endpoint Protection client.

Table: Command-line options for the QEXTRACT command

Command options | Description
--- | ---
/INFO | Displays basic Quarantine information but does not extract any files.
/DETAILED | Displays detailed Quarantine information but does not extract any files.
/FILE:file name | Restores a file or folder from the Quarantine. Typically, you use this option to restore items on multiple computers. You can use a file name only to restore any instance of an individual file. For example, you might type the following syntax: `QEXTRACT /FILE:notepad.exe` You can also use a path name for the file name. If you use the full path name for the file, the individual file is restored. For example, you might type the following syntax: `QEXTRACT /FILE: c:\Windows\System32\notepad.exe` You can use a partial path, where everything in the path is restored. For example, you might type the following syntax to restore all files under the Program Files folder: `QEXTRACT /FILE: "\Program Files"`
Note: | The path and the file name are not case-sensitive. Use quotation marks when there are spaces in the path name or file name.
/RISK:risk name | Extracts a file with a specific risk name or files with risks of a certain type. Typically, you use this option to restore items on multiple computers. For example, you might want to restore the files that are associated with a particular worm. You might type the following syntax: `QEXTRACT /RISK:W32.UglyWorm` You can use a partial risk name. For example, you might type the following syntax to restore all files with W32 risks: `QEXTRACT /RISK:W32` You can restore all the files that that are associated with worms by typing the following syntax: `QEXTRACT /RISK:WORM` You can restore all the files that are associated with security risks by typing the following syntax: `QEXTRACT /RISK:SecurityRisk`
Note: | The risk name is not case-sensitive.
/RESTOREALLQUARANTINE | Restores all infected files in the Quarantine.
/RESTOREALLBACKUP | Restores all backed-up files in the Quarantine.
/RESTOREALLREPAIR | Restores all repaired files in the Quarantine.
/NOSTATUS | Disables any output on the client computer.
/OVERWRITE | Overwrites any existing files when the command restores files on the client computer.
/DELETEAFTER | Deletes the items from the Quarantine after the items are successfully restored on the client computer.
/SESSION:session ID | Extracts and restores the files that are associated with a specific session from the Quarantine. For example you might type the following syntax: `QEXTRACT /SESSION:00A80000` You can use the /INFO or /DETAILED option to verify the session IDs.

## Legal notice

^Back to top

Product version: 14.x

Documentation version: 3

This document was last updated on: February 18, 2020

Broadcom, the pulse logo, Connecting everything, and Symantec are among the trademarks of Broadcom.

Copyright © 2020 Broadcom. All Rights Reserved. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries.

For more information, please visit https://www.broadcom.com.