> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://cla-demo.postmansolutions.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://cla-demo.postmansolutions.com/_mcp/server.

# Malware Quarantine Soft Delete and Recovery

## Purpose

Define how files are handled after a malware scan result is received, including quarantine behavior, soft delete handling, and recovery actions

---

## Scope

This document applies to files uploaded through File Intake that receive malware scan results from Microsoft Defender for Storage

---

## Data Model Alignment

This behavior is anchored on the \[fileIntake].\[File] table

Relevant fields:

* FileID
* InternalUrl
* MalwareScanResult

> InternalUrl identifies the blob in storage

> MalwareScanResult contains the scan result returned by Defender.

---

## Quarantine Behavior

* Quarantine is applied when MalwareScanResult equals Malicious
* Quarantine is implemented using Blob Storage soft delete
* The blob identified by InternalUrl is soft deleted
* The database record remains intact

---

## Non-Quarantine Conditions

* Files are not quarantined when MalwareScanResult is:
  * No Threat Found
  * Error
  * Not Scanned
  * null

---

## Processing Gate

* Files are eligible for downstream processing only when: `MalwareScanResult` equals `No Threat Found`
* Files are blocked from downstream processing when:
  * `MalwareScanResult` is Malicious
  * `MalwareScanResult` is Error
  * `MalwareScanResult` is Not Scanned
  * `MalwareScanResult` is null

---

## Error Handling

* Error indicates Defender attempted a scan and did not complete successfully
* Files with `MalwareScanResult` equal to Error remain blocked
* No automatic retry behavior is defined in this document

---

## Not Scanned Handling

* Not Scanned indicates Defender did not scan the file
* Files with `MalwareScanResult` equal to Not Scanned remain blocked

---

## Recovery Behavior

* Recovery actions are initiated manually or through operational workflows
* Recovery may include:
  * Restoring a soft-deleted blob
  * Re-uploading the file
  * Re-triggering a scan through storage-level actions
* Recovery behavior does not modify historical scan results

---

## Soft Delete Retention

* Blob retention is governed by storage account configuration
* File Intake does not control soft delete retention duration

---

## Audit and Observability

* `MalwareScanResult` is retained on the file record
* Blob deletion and restoration events are logged by the storage platform
* No additional audit schema is defined in this document