Cryoserver back from the dead

Sealed box merges regulatory compliance and email archiving

By Bryan Betts • Get more from this author

Posted in Storage, 25th April 2007 18:41 GMT

Join our expert panel in discussing application security

Email archiving system Cryoserver is back, and now it's an appliance. The software has been bought up by Dublin-based developer FCS (Forensics & Compliance Systems) which has used it to build a tamper-proof sealed system able to archive all one's messaging, both for regulatory compliance and for storage management.

"It's a bucket that all your email goes into - a very focused content archiving solution for email and IM," said Ralph Harvey, FCS's CTO. "It gives you compliance, but also gives you the ability to discover, and it's mirrored and synchronised so there's no need to back-up."

He added that there's two broad areas in email archiving, namely compliance and pure storage management. The latter involves moving content out of your email app - if it's Outlook, then preferably before your local file reaches 2GB and dies - and putting it where is can be searched and protected properly. Stubs are left behind in the email app so you can still get to your old messages from there.

"We came from the compliance side and now we can do storage management too. Our selling point is the search application on top - it's the only way you can truly find content and attachments," Harvey said.

FCS is now preinstalling Cryoserver on Network Engines hardware to create the appliance. The system includes de-duplication and stores messaging data in encrypted form, along with MD5 hashes which can be used later to prove the integrity of the message.

The largest Cryoserver available is a 2U box with dual quad-core processors and 6TB of SATA disk, which Harvey claimed should be enough for 5000 users over two years. If you need more space, up to four Cryoservers can be stacked, he said, and the range starts at EUR 7000 (£4800).

"What makes it legally valid is we can show beyond reasonable doubt that a message has not been changed," he added. "We can mathematically assert that it was the message you received. When people say they weren't party to information, we can show that they did or didn't get an email.

"You can delete an email, but only through an audited process, and we have tracking of who has viewed what. Everything goes in the bucket, the only policy is for how long - and the O/S is locked down, so you can't change the clock." ®

See what The Register's experts have to say on application security