Which technique is used to protect end user devices and data from unknown file behavior?

File hash calculation identifies known malicious files, but it does not protect against unknown file behavior or zero-day threats.

File retrospection continuously scans and analyzes files over time, but it typically acts after an initial compromise or uses behavior analysis in conjunction with other techniques; it's not the primary technique for initial protection from unknown behavior.

File sandboxing involves detonating (executing) suspicious or unknown files in a secure, virtualized environment that mimics a real operating system. This allows security systems to analyze the file's behavior, identify malicious actions, and determine its threat level without posing a risk to actual end-user devices or data.

Phishing file quarantine deals with files from phishing attempts and stores them, but it's a reactive measure for known threats rather than a proactive analysis for unknown file behavior.