The present disclosure provides a file quarantine method, apparatus, and system. The method includes: receiving by an input/output (I/O) object manager, a change operation request from a first process for a volume device in a file system; and if it is determined that the first process is a process inside a sandbox, redirecting the change operation request to a virtual volume device corresponding to the volume device which is pointed to by the change operation request, and sending the redirected change operation request to the I/O object manager. The foregoing solution may implement file quarantine at a volume device level.