Reverse, Reveal, Recover: Windows Defender Quarantine Forensics

This report documents reverse-engineering of Windows Defender's quarantine format (mpengine.dll) to reveal undocumented metadata and structures (QuarantineEntry, QuarantineEntryResource, QuarantineEntryResourceField, WIN32_STREAM_ID handling). The authors show how to decrypt and parse the three RC4-encrypted sections of QuarantineEntry files, recover quarantined file contents and NTFS alternate data streams (e.g., Zone.Identifier and security descriptors), and implement the parser as a plugin for the Dissect DFIR framework using dissect.cstruct to aid forensic recovery.