Backup

Kaspersky Security can save message copies in Backup before processing them with application modules. Copies of messages are placed in Backup together with all attachments.

Kaspersky Security saves message copies in Backup in the following cases:

• After scanning a message by the Anti-Virus module, before modifying the message as a result of the Delete message or Delete object action, provided that the application is allowed to save message copies in Backup during an Anti-Virus scan
• After scanning a message for spam and phishing, before performing the Delete or Reject action on the message, provided that the application is allowed to save message copies in Backup during an Anti-Spam and Anti-Phishing scan
• When filtering attachments and content, provided that the application is allowed to save message copies in Backup during attachment and content filtering.

You can manage copies of messages in Backup as follows:

• View Backup contents.
• View the details of messages in Backup.
• Filter the details of messages in Backup for convenient viewing and searching of message details.
• Save messages from Backup to disk in order to view information contained in the message. You can also attempt to rescan the saved message with Anti-Virus with the updated database.
• Deliver messages from Backup to recipients. Saved objects will be delivered to the recipients.
• Forward messages from Backup to manually specified email addresses.
• Delete message copies from Backup.

Information about Backup objects is stored in the SQL database specified during installation of the application. If several Security Servers use the same SQL database (for example, in a DAG server configuration), Backup stores messages received from each of these Security Servers.

Messages are stored in Backup in encrypted form, which eliminates the risk of infection and speeds up the operation of Anti-Virus (files in Backup format are not detected as infected).

The total number of objects in Backup is limited to one million. You can additionally limit the size of Backup by imposing limitations on the size of Backup and the duration of object storage in Backup.

The application checks every minute if these limitations are not exceeded. Based on the results of the check, the application can perform the following operations:

• If the allowed number of objects in Backup is exceeded, the application removes an appropriate quantity of the oldest objects.
• If there is a limit on Backup size in megabytes, and this limit is exceeded when a new message is moved to Backup, the application frees up the required space by deleting the oldest objects.
• If the message storage period is limited, the application deletes messages whose storage period has expired.