Windows Defender Quarantine Forensics Guide

This report presents a technical analysis of Windows Defender quarantine internals: reverse engineering mpengine.dll to uncover previously undocumented QuarantineEntry and QuarantineEntryResourceField structures, demonstrating how quarantined files and metadata (including timestamps, NTFS alternate streams like Zone.Identifier, and security descriptors) are stored and RC4-encrypted, and providing a Dissect framework plugin that recovers these artifacts for DFIR purposes.