Windows Defender Quarantine & DetectionHistory

Location

Description

Windows Defender quarantine directory containing encrypted copies of detected malware (ResourceData) and detection metadata (DetectionHistory) recording threat name, file path, detection time, user context, and remediation action taken.

Forensic Value

Defender quarantine preserves the original malware sample even after it was removed from its original location, enabling full malware analysis. The ResourceData files can be decrypted to recover the exact binary for reverse engineering and hash-based threat intelligence correlation. DetectionHistory files provide structured detection metadata showing what was detected, where, and when. This is invaluable when the attacker deletes the original malware after detection.

Tools Required