After connecting Defender to the network, the mail server is configured to send copies of all inbound, outbound and internal messages to the TSI Defender appliance. This is called a journal process. When the Defender receives these messages, it fully indexes and archives the email headers, bodies and attachments in real-time so that they can be searched, viewed and retrieved with the Defender’s search engine.

After the indexing information is stored in the database, the raw message bodies are compressed and stored in the Defender file system to improve database performance and system scalability. Each message is stored only once to maximize storage efficiency.

Users and administrators may search, view and retrieve email by logging in to Defender’s secure web interface. The Defender uses SSL and encrypts all data between the appliance and the user, so email does not travel unencrypted across the network. Users can be given permission to search email sent to or from them, while administrators can search the entire enterprise email archive. Defender can also be made accessible through the firewall and accessed remotely using any web browser, including PDA devices.