About retrieving Disarmed content
Removal of potentially malicious content (PMC) from email attachments with Disarm may affect both visual fidelity and function in the reconstructed documents. For example, the appearance of a document may change if embedded fonts are removed and replaced with system fonts. Functionality may be lost if the original documents contain elements (such as text input forms) implemented with macros. The input fields may still exist in the reconstructed documents, but may no longer provide input validation or visual feedback after the attachment is Disarmed. Similarly, mouse actions or keyboard input that is controlled by JavaScript may no longer work if JavaScript is removed.
PMC removal can also cause more global losses of functionality in a document, or even loss of content. For example, if you Disarm all macros in Microsoft Office documents, then an Excel spreadsheet that uses macros may no longer work as intended. Similarly, if you choose to reconstruct embedded files and attachments from an email message, then attached or embedded content that Disarm does not support is discarded.
The only way to retain the original content with all of its functionality is to archive all messages with attachments. To archive messages, you first specify the location in which to store the archive. Then you specify "Archive the message" as an action for your Disarm policy or policies. On the
Edit Email Malware Policy
page, in the Actions
area, click Add
and select "Archive the message" from the Configure an action
drop-down list.