Question: [This Super User question](https://superuser.com/q/1096317/479461) made me ask, is it really a good idea to keep files in quarantine, when you don't know what they are yet? For what I know there are more or less 2 steps that need to be performed for "losing control" of your system. First there has to be some malicious code to be injected to the system and then there needs to be a way to execute it. So what measures does AV software take for "in quarantine"-files to avoid this? I'm assuming, the case where the user is just executing the file isn't the problem. I.e. how to make sure that not a bug is causing some overflow resulting in execution of the code?

In other words: What does AV software do to prevent execution of quarantined files, and can I rely on them not being able to get executed anyway?

**NOTE:** I'm not asking about the ways AV's are performing the quarantine feature. The core of the post is: "What are the ways quarantine features are protecting themselves/quarantined files from beeing tricked/decoded/whatever and getting executed anyways and how likely is it this could happen?"

Answer: 
Suppose you have an important file(say, some presentation) that is flagged by your antivirus as "malicious". You do not wish to delete it(it's important after all, even if it is malicious!), but you don't want your machine to get infected as well.

So, what option do you have? Your antivirus product can `quarantine` it. It keeps the files in an isolated environment on your disk, so that malicious files do not pose a threat to your machine.

There are different approaches as to how these files can be handled:
1) moving the file to a different location
2) renaming the file, changing the format of the file
3) changing the permissions of the file, marking it as hidden
4) encrypting or encoding the file, so that even accessing the file would render the malicious code useless

Now what if you want the file back, even after you understand that it might wreak havoc, or might be just a false-positive? Antivirus products give you the option to move the quarantined file from quarantine to the original location, in the original format, so it is usable again for you(at your own risk, of course!).

If you strongly suspect that your file is harmless, you can try scanning it with other antivirus(say, on [Virustotal](http://virustotal.com)). You can also ask your antivirus product vendor to recheck the file for any malicious behavior. Once you're satisfied that it is harmless, you can safely go ahead and restore the file from quarantine.

And yes, you can rely on quarantine features of any reputed antivirus product.
It's unlikely that any file would execute without a user having granted that permission. That user could have been someone who prepared the factory image, or you when you ran another program.

To prevent (malicious) content from being accessed, a sure way is to use a completely separate machine to encrypt it using a One Time Pad of the same length as the content, and then keeping the encrypted content and the pad separate until it's time to access the content. Stray execution pointers are rare in stable code, and as such should not execute the malicious content even when it's been decoded. Unless, of course, the decoder was written in an unsafe language and contains a bug that the content knows to exploit. (See JPG exploits.)

If you don't wish to salvage the content, then shredding it from orbit (boot from a secure read-only media) should ensure it never returns... if you use an HDD. SSDs are known to manage their own storage cells in a way that offers no guarantee that the data those cells contain is gone. Even HDDs need multiple overwrites according to army specs, and many companies physically shred the drives to ensure no economical data recovery.