Completed (Content Update)

PE files are quarantined and can be restored - only up to 50MB

https://docs.sophos.com/central/Customer/help/en-us/central/Customer/concepts/ConfigureMalwareProtection.html

The above link states:

  • We always clean up PE (Portable Executable) files like applications, libraries, and system files, even if you turn off automatic cleanup. PE files are quarantined and can be restored.

However, there are cases where PE files cannot be restored. From safestore.log:

2021-05-27T07:57:24.702Z Savefile: C:\path\to\file.exe

2021-05-27T07:57:24.702Z SafeStore_SaveFile() failed (error 15)

2021-05-27T07:57:24.702Z Task failed (result: -1, reason: "SafeStore_SaveFile() failed (result 15)")

Support informed me in case number 04065361 that:

SR_MAX_OBJECT_SIZE_EXCEEDED

15

The file is over maximum size (Default 50MB), not backed up

(Result 15)

Kindly update the documentation to reflect this.

Parents Comment Children
No Data