Email Forensics

Email Forensic Software that is Fast, Accurate, and User-Friendly

If you are a lawyer or need a tool to prepare for litigation, please visit our “Email E-Discovery” page.

Aid4Mail is a fast, accurate, and easy-to-learn email forensics software solution. Over the years, it has become an essential tool for computer forensics and e-discovery professionals around the world.

Aid4Mail supports over 40 email formats and mail client programs, as well as many popular webmail services and remote accounts through IMAP. As a result, you’ll be able to process just about any type of mailbox that comes your way.

Local mail folders and files can easily be processed when disconnected from their email client, including those stored on external hard drives and media like DVD and USB devices. Aid4Mail can read mbox files from Mac and Linux systems without prior conversion.


What Can You Expect With Aid4Mail?

Here are some of the benefits you’ll get with Aid4Mail:

  • Dependable, with results that are more accurate than other solutions.
  • Easy-to-learn interface and context-sensitive help to make your job easier.
  • Saves time with its fast email processing engine and de-duping features.
  • Finds relevant information, thanks to its powerful search features.
  • Good value for money, with prices as low as .

But that’s not all. Aid4Mail integrates accessibility features making it Section 508 compliant. This means it fulfills the necessary requirements for use in U.S. government agencies.

Aid4Mail’s user-friendly wizard interface
Aid4Mail’s user-friendly wizard interface

Accurate Email Data Acquisition

Aid4Mail easily handles very large messages and attachments, and huge mailbox files. It often succeeds in extracting mail from corrupt mailboxes and fixing malformed emails. Aid4Mail can also restore deleted and unpurged emails from many mailbox formats and IMAP mail accounts.

Aid4Mail is one of the most accurate tools on the market when it comes to rebuilding mail. When programs like Outlook and Eudora receive an email, they alter and split it prior to saving in the mail store. Traditional forensics tools are often incapable of correctly putting the pieces back together. As a result, collected data is incomplete and searches miss relevant chunks of data.

Aid4Mail can rebuild emails, producing a format that is as faithful as possible with the original RFC message. Source metadata like SMTP header fields are recovered, status information and dates restored, and attachments and embedded contents copied back into the email. Example using a competing product, followed by Aid4Mail:

From: "david.johnson@fookes.com" <david.johnson@fookes.com>
To: "'J=?UTF-8?Q?=c3=a9r=c3=b4me=20Ar=c3=a7?=ois'" <jerome.arcois@fookes.com>
cc: "'Joan Miller'" <joan.miller@fookes.com>
cc: "'Susan Williams'" <susan.williams@fookes.com>
cc: "'Peter Smith'" <peter.smith@fookes.com>
cc: "'Eugene Fookes'" <eugene.fookes@outlook.com>
Importance: High
X-Mozilla-Status: 0001
Subject: Please=?UTF-8?Q?=20check=20important=20charts=20from=20Snj=c3=b3fr=c3=ad=c3=b0?=ur
MIME-Version: 1.0
Message-ID: <!&!AAAAAAAAAAAYAAAAAAAAABluo5KJeUpCslhvgKM4mZnCgAAAEAAAAIGHdE3Z8MdFhGLsK9UnDgUBAAAAAA==@fookes.com>
Date: Tue, 25 Feb 2014 10:58:18 +0100
Content-Type: multipart/mixed;boundary="Next_Item:_(A3CB49KFSA19)/1"
          
Same header extracted by competing eDiscovery tool
x-store-info:sbevkl2QZR7OXo7WID5ZcVBK1Phj2jX/
Authentication-Results: hotmail.com; spf=pass (sender IP is 96.30.47.96) smtp.mailfrom=david.johnson@fookes.com; dkim=pass header.d=fookes.com; x-hmca=pass header.id=david.johnson@fookes.com
X-SID-PRA: david.johnson@fookes.com
X-AUTH-Result: PASS
X-SID-Result: PASS
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0xO0Q9MTtHRD0xO1NDTD0w
X-Message-Info: NhFq/7gR1vQRHV6jbdvQfsKUeeVAoUVojAJS6DKEC2GNUUM0G+Idi8S6bQ+yOheURPNKM+ceVA3sxGBBdP1EXLOQS4fNzCSzxNSv8LmL1zB6Ig6GoQXO4AY+byEwxgTcdu3BFpOcpQKVeZatIvi3zNJwl3djyhVsTq2RhIH+qQHVu5h8LDsU9uzF2wTW29UAon9Bseo3FpdNC8Y22VXkKMPttP2iurtq
Received: from host.fookes.com ([96.30.47.96]) by SNT0-MC2-F45.Snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
	 Tue, 25 Feb 2014 01:58:16 -0800
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=fookes.com; s=default;
	h=Content-Type:MIME-Version:Message-ID:Date:Subject:Cc:To:From; bh=JaM6HEHiGymnxtuIqtQZ1XV3kKOd0Dqhq6gZ6oaSzq0=;
	b=Nd6UJ2o9NjyP7XSxjt+6UnJ1b/l+yNXeKRoJ2ILQSSHOKG8NZ0w+97n7wcWdu9yD7wxMlzPKBHgFt3Am8GtSBYfRtcyT1Aqv4fS0/YHNsIg8BH5d5PHRr8lqJ8cLpXWMgXruP1L2dUYeDDb+UgbkHfIz+uOF0BnMyWOFKUuvV4k=;
Received: from 80-218-191-28.dclient.hispeed.ch ([23.247.123.38]:58440 helo=T3500)
	by host.fookes.com with esmtpsa (TLSv1:AES128-SHA:128)
	(Exim 4.82)
	(envelope-from <david.johnson@fookes.com>)
	id 1WIEmF-0000dK-An; Tue, 25 Feb 2014 03:58:15 -0600
Return-Receipt-To: <david.johnson@fookes.com>
From: <david.johnson@fookes.com>
To: =?iso-8859-1?B?J0rpcvRtZSBBcudvaXMn?= <jerome.arcois@fookes.com>
Cc: "'Joan Miller'" <joan.miller@fookes.com>,
	"'Susan Williams'" <susan.williams@fookes.com>,
	"'Peter Smith'" <peter.smith@fookes.com>,
	"'Eugene Fookes'" <eugene.fookes@outlook.com>
Subject: =?iso-8859-1?Q?Please_check_important_charts_from_Snj=F3fr=ED=F0ur?=
Date: Tue, 25 Feb 2014 10:58:13 +0100
Message-ID: <!&!AAAAAAAAAAAYAAAAAAAAABluo5KJeUpCslhvgKM4mZnCgAAAEAAAAIGHdE3Z8MdFhGLsK9UnDgUBAAAAAA==@fookes.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;
	boundary="----=_NextPart_000_0000_01CF3218.7BF01810"
X-Priority: 1 (Highest)
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook 14.0
Importance: High
Thread-Index: Ac8yDzP4nnZLjzY8SdeZrtR0leJ50g==
Content-Language: en-us
Disposition-Notification-To: <david.johnson@fookes.com>
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - host.fookes.com
X-AntiAbuse: Original Domain - outlook.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - fookes.com
X-Get-Message-Sender-Via: host.fookes.com: authenticated_id: david.johnson@fookes.com
X-Source:
X-Source-Args:
X-Source-Dir:
Return-Path: david.johnson@fookes.com
X-OriginalArrivalTime: 25 Feb 2014 09:58:16.0790 (UTC) FILETIME=[1AD27760:01CF3210]
Status: RO
X-Folder: Copies
          
Same email with header extracted by Aid4Mail

Output Formats for Delivering and Filing Email Data

Aid4Mail offers several export options to ease the delivery and filing of collected email data. It can convert messages to PDF or HTML to facilitate file sharing with the court and legal teams. Aid4Mail can also create PDF/A-1a (Level A Conformance) files which are being adopted by federal courts in the U.S. as the standard format for electronic filing (CM/ECF systems).

If you need to analyze or process mail further using other tools, Aid4Mail can export messages to standard Outlook PST files, mbox (formatted for Windows, Mac, or UNIX/Linux), individual EML message files, CSV (supported by Microsoft Excel and most databases), XML, and more. Custom output formats can also be created with Aid4Mail’s powerful scripting capabilities.


Command-Line Option

Aid4Mail Console is a command-line edition that can be used to automate examination tasks and batch process email files and accounts. Unlike the wizard edition of Aid4Mail, the console edition can process multiple PST files unattended.

Aid4Mail Console is included in the price of Aid4Mail eDiscovery Service and is available as a bundled option with Aid4Mail Forensic.


Who Uses Aid4Mail?

Aid4Mail has many thousands of satisfied users around the world, including law enforcement and government agencies, intelligence and military organizations, law firms, large corporations and financial institutions, audit firms, as well as consultants and students of computer forensics.

And it’s no wonder. Aid4Mail was developed specifically to meet the high demands of forensic and e-discovery professionals.


Here’s What our Users Had to Say About Aid4Mail

“We work with over 1TB [one terabyte] of email per month and your Aid4Mail product has shown to be an integral part of our toolset for dealing with these volumes of email.”
– Jason Rappoport, USA
“I work for a lawfirm and we used your product to convert a MBOX file to PST. This software worked brilliantly, it even fixed corruption that existed when we attempted to do it manually or with other software. Thank you for that.”
– Gregory Kerr, Lubin Olson & Niewiadomski LLP, USA
“Aid4Mail scripted approach took just 8 hours to finish (!), which is almost impossible to compare with 23 hours of running time for Transend. On top of everything else, it looks like that Aid4Mail-generated PST files are way smaller than Transend-generated.”
– Dragan Stankovic, Canada
“Works exactly as advertised, a rare and welcome thing these days.”
– Alan Mintaka, USA
“The product has done a fantastic job and the support has been first class.”
– Peter Hopkin, UK

Try Aid4Mail for Free

Take advantage of our free trial and start using Aid4Mail today. There’s no sign-up form to download Aid4Mail and you can run it in trial mode for as long as you need. This way you can verify that Aid4Mail is fully compatible with your computer and does what you require.

Click to download your FREE Aid4Mail trial.


Ready to Buy Now? It’s Quick and Easy

Thank you for choosing Aid4Mail. Please note that you need one license per . See our EULA for the details. You can specify the number of licenses on the next screen.

Aid4Mail Forensic
Primarily for Public Sector

  •  CLI console: optional (+ $299 US)
    Private Sector:
     Limited to internal mail
    Public Sector:
     Unlimited end-users mail
     Multi-seat option
  •  One-Year License
     50% discount on renewal
  •  Supports MS Exchange
     Filter mail by date/keywords
     Process/restore unpurged mail
  •  Also converts to PDF/A
     Offline license activation

Aid4Mail Service
Primarily for Private Sector

  •  CLI console: included
    Private Sector:
     Unlimited end-users mail
    Public Sector: :
     Unlimited end-users mail
     Multi-seat option
  •  One-Year License
     50% discount on renewal
  •  Supports MS Exchange
     Filter mail by date/keywords
     Process/restore unpurged mail
  •  Also converts to PDF/A
     Offline license activation

Double-check the system requirements here…

  • Operating System : Aid4Mail runs under Windows 8, 7, Vista, XP, 2000, Server 2012, 2008 and 2003 or Linux in conjunction with Wine. Both Windows 32-bit and 64-bit are supported.
    Windows NT4 / ME / 98 / 95 should work but are not officially supported.
  • Internet : Online license activation, validation, and re-activation require an internet connection (offline activation option available with Aid4Mail eDiscovery editions).
  • Hardware Requirements : 64 MB of RAM, 12 MB disk space. Pentium (or compatible) processor.

IF YOU’LL BE PROCESSING OUTLOOK/EXCHANGE:

  • Aid4Mail currently does not support the 64-bit versions of Office Outlook 2010 or 2013. But Windows 64-bit with Outlook 32-bit is fine.
  • Office Outlook (32-bit version) must be installed to process mail to or from Outlook/Exchange profiles, *.msg and *.pst files.
    If you don’t have Outlook, you can use Microsoft’s free 60 day trial of Office Outlook for Windows. Alternatively you can use their free standalone version of MAPI but note that it doesn’t support Unicode PST files (which may be used in Outlook 2003 and later versions).
  • Aid4Mail may not be compatible with Click-to-Run installations of Outlook 2010; you will need to re-install Outlook 2010 using another method following Microsoft’s instructions. This is not the case for Outlook 2013 which works fine with Aid4Mail 3.
  • If you have Outlook 98/2000 then it should be installed in Corporate/WorkGroup mode in order to process PST and MSG files. If it is installed in Internet Mail Only (IMO) mode, then only the default MAPI profile can be processed.
  • There may be compatibility issues with Outlook 97.
  • PST files from Outlook 2001 for Mac are supported, but not those from Outlook 8.x for Mac. Outlook 2011 for Mac can import PST files created by Aid4Mail.
  • Microsoft Exchange can either be processed through an Outlook/MAPI mail profile, or through the IMAP protocol in which case the Exchange server needs to be set up for IMAP access (see instructions).

Aid4Mail can read mail from:

  • Microsoft Exchange through Outlook/MAPI (1) (except Aid4Mail Home) or IMAP (2),
  • Outlook Personal Storage files (1) (*.pst),
  • Outlook MSG files (1) (*.msg),
  • Outlook Express versions 5 and 6 (*.dbx, *.eml and *.nws),
  • Outlook Express version 4 (*.idx and *.mbx),
  • Windows Live Mail (*.eml;*.nws),
  • Windows Mail (Vista mail client),
  • IMAP accounts,
  • Webmail services that offer IMAP access, e.g. Gmail, Yahoo! Mail, AOL Mail, FastMail, GMX Mail, Outlook.com, Outlook 365, etc,
  • Mozilla Thunderbird mailbox files,
  • SeaMonkey mailbox files,
  • Netscape mailbox files,
  • Apple Mail (Mail.app) message files (*.emlx),
  • Qualcomm Eudora mailbox files (*.toc and *.mbx),
  • Eudora OSE mailbox files,
  • Macintosh Eudora mailbox files,
  • Generic mailbox files (mbox, Entourage MBOX, Evolution, Berkeley mail, BSD mail, Unix mail format),
  • EML message files (*.eml),
  • MHT Web Archive files (*.mht),
  • Pegasus mailbox files (*.pmi, *.pmm, and *.cnm),
  • The Bat! mailbox files (3) (*.msb and *.tbb),
  • PocoMail mailbox files (*.idx, *.idb, and *.mbx),
  • Barca mailbox files (*.idx, *.idb, and *.mbx),
  • FoxMail mailbox files up to version 6.5 (*.box),
  • Opera mailbox files (*.mbs),
  • Calypso and Courier archive files,
  • Forte Agent mailbox files (*.idx),
  • Pine mbox files (with limited “From ” escaping),
  • PMMail message files (*.msg),
  • Maildir folders (local copies),
  • MSN Mail v8 (*.MailDB),
  • Mailbag Assistant mailbox files (*.mbg),
  • E-mail Examiner mailbox files (*.pmx),
  • Aid4Mail ZIP archives (*.zip).

Aid4Mail can export/save mail to:

  • Microsoft Exchange through Outlook/MAPI (1) (except Aid4Mail Home) or IMAP (2),
  • Outlook Personal Storage files (1) (*.pst),
  • Outlook MSG files (1) (*.msg) – only if source mail comes from Microsoft Exchange or Outlook files,
  • Windows Live Mail,
  • Windows Mail (Vista mail client),
  • IMAP accounts,
  • Webmail services that offer IMAP access, e.g. Gmail, Yahoo! Mail, AOL Mail, FastMail, GMX Mail, Outlook.com, Outlook 365, etc,
  • Mozilla Thunderbird mailbox files,
  • SeaMonkey mailbox files,
  • Eudora OSE mailbox files,
  • Netscape mailbox files,
  • PocoMail mailbox files (*.mbx),
  • Barca mailbox files (*.mbx),
  • Generic mailbox files, (mbox, Entourage MBOX, Evolution, Berkeley mail, BSD mail, Unix mail format),
  • EML message files (*.eml),
  • XML files (*.xml),
  • Plain text files (*.txt),
  • MHT Web Archive files (*.mht) - linked from an HTML index page or an MS Excel Workbook file (not available in Aid4Mail Home),
  • MHT files with tab-delimited data file for import into a database (not available in Aid4Mail Home),
  • Adobe Acrobat PDF files (not available in Aid4Mail Home),
  • Aid4Mail ZIP archives (*.zip).

Notes:

  1. To process (from/to) Outlook MSG files, PST files, and Outlook/MAPI mail profiles, Aid4Mail requires either a 32-bit version of Office Outlook or a standalone version of MAPI. For details, free options, and limitations, see the System Requirements.
    Only Aid4Mail Console can export a source MAPI profile or PST file to a target MAPI profile or PST file. With Aid4Mail Home, Aid4Mail Professional, and Aid4Mail eDiscovery, the workaround is to first export your emails to the Outlook MSG format, and then re-export those files to your target format.
  2. Microsoft Exchange can either be processed through an Outlook/MAPI mail profile (1), or through the IMAP protocol in which case the Exchange server needs to be set up for IMAP access (see instructions).
  3. Aid4Mail cannot process encrypted The Bat! mail files. In this case, you will first have to export your messages with The Bat! to a Generic mailbox format, which Aid4Mail can then process to any of the supported formats.
  4. Aid4Mail currently does not offer tools to convert address books, filters, or account settings from one format to another.

P.S.

If you need a fast and accurate email forensic tool, you can trust Aid4Mail to do the job for you. Get your license now and start investigating email today, or test drive Aid4Mail for free in trial mode and see for yourself how well it works.