When you issue a command to delete files, the request is sent to the agents the next time the server and agent communicate, normally at 30 second intervals.
Depending on the number of files and agents involved, actual deletion of files and reporting those deletions back to the server can take from approximately 30 seconds to several minutes.
Requests to delete files on offline computers remain active until the files are actually deleted. These files will be deleted when their endpoints reconnect to the server. However, new file instances discovered after a delete request is processed will not be deleted.
During the time between a deletion request and actual deletion of a file on an endpoint, other actions related to the file might take place. If a user moves a file during this period, it will still be deleted from the server unless it is moved to a location in which file tracking is disabled, for example, because of a Performance Optimization rule.
A server-initiated file delete command can only delete files that are currently tracked in agent’s inventory. Deletion of a file by the endpoint user (i.e., moving it to the Recycle Bin) might prevent successful completion of a server-initiated file deletion. By default, the agent only tracks a file in the Recycle Bin if the file has been executed from the Recycle Bin. For files in the Recycle Bin that have not been executed there, a server-initiated delete action will fail and report that failure in an event.
You can delete a file that has been scheduled for upload to the Carbon Black App Control Server or upload and analysis by a third-party network security service, and it is possible that the deletion will occur before the upload or analysis. Keep this in mind if you want to analyze a file before choosing to delete it.
