File Created Date shows n/a for quarantined file

Products

• Endpoint Protection

Issue/Introduction

A large multi-layered compressed file is quarantined by Endpoint Protection and the file creation time shows as N/A instead of the actual date under View Quarantine.

Cause

The file has multi-layered compression files embedded in it. "Scan Error decomposer too deep (525)".

Resolution

This is by design from SEP architecture.

For testing, create an application using FA.CMD file which is 5.4 GB in size and the Windows API itself will fail, hence the file status cannot be displayed correctly.
So this is not a bug by SEP but Windows API is failing to get the file statistics like size, creation time, etc. 

For more details, review the code mentioned here: https://docs.microsoft.com/en-us/cpp/c-runtime-library/reference/stat-functions?view=msvc-170