OfficeScan 11.0 SP1 CP Build 6054 provides an enhancement that enables the Behavior Monitoring program inspection feature to detect and block compromised executable files to improve protection against ransomware threats and provide a visibility widget for ransomware prevention.
One of the Behavior Monitoring (BM) settings enabled by default after installing this critical patch is it automatically backs up files changed by suspicious programs, which is a newly added feature.
Administrators may need to determine the following:
- The location of the files backed up by BM
- The storage size of the backup folder
- The duration the files are kept in the backup folder
You can go to C:\Program Files (x86)\Trend Micro\OfficeScan Client\CCSF\module\DRE\data\Backup for the default BM file backup folder of the agent machines.
The storage size of the folder is set to 100 MB.
Backed up files are kept in the folder for 14 days.