Email Forensics

Email Forensic Software that is Fast, Accurate, and User-Friendly

Aid4Mail is a fast, accurate, and easy-to-learn email forensics software solution. Over the years, it has become an essential tool for computer forensics and e-discovery professionals around the world.

Aid4Mail supports over 40 email formats and mail client programs, as well as many popular webmail services and remote accounts through IMAP. As a result, you'll be able to process just about any type of mailbox that comes your way.

Local mail folders and files can easily be processed when disconnected from their email client, including those stored on external hard drives and media like DVD and USB devices. Aid4Mail can read mbox files from Mac and Linux systems without prior conversion.


What Can You Expect With Aid4Mail?

Here are some of the benefits you'll get with Aid4Mail:

  • Dependable, with results that are more accurate than other solutions.
  • Easy-to-learn interface and context-sensitive help to make your job easier.
  • Saves time with its fast email processing engine and de-duping features.
  • Finds relevant information, thanks to its powerful search features.
  • Good value for money, with prices as low as .

But that's not all. Aid4Mail integrates accessibility features making it Section 508 compliant. This means it fulfills the necessary requirements for use in U.S. government agencies.

Aid4Mail's user-friendly wizard interface
Aid4Mail's user-friendly wizard interface

Accurate Email Data Acquisition

Aid4Mail easily handles very large messages and attachments, and huge mailbox files. It often succeeds in extracting mail from corrupt mailboxes and fixing malformed emails. Aid4Mail can also restore deleted and unpurged emails from many mailbox formats and IMAP mail accounts.

Aid4Mail is one of the most accurate tools on the market when it comes to rebuilding mail. When programs like Outlook and Eudora receive an email, they alter and split it prior to saving in the mail store. Traditional forensics tools are often incapable of correctly putting the pieces back together. As a result, collected data is incomplete and searches miss relevant chunks of data.

Aid4Mail can rebuild emails, producing a format that is as faithful as possible with the original RFC message. Source metadata like SMTP header fields are recovered, status information and dates restored, and attachments and embedded contents copied back into the email. Example using a competing product, followed by Aid4Mail:

From: "david.johnson@fookes.com" <david.johnson@fookes.com>
To: "'J=?UTF-8?Q?=c3=a9r=c3=b4me=20Ar=c3=a7?=ois'" <jerome.arcois@fookes.com>
cc: "'Joan Miller'" <joan.miller@fookes.com>
cc: "'Susan Williams'" <susan.williams@fookes.com>
cc: "'Peter Smith'" <peter.smith@fookes.com>
cc: "'Eugene Fookes'" <eugene.fookes@outlook.com>
Importance: High
X-Mozilla-Status: 0001
Subject: Please=?UTF-8?Q?=20check=20important=20charts=20from=20Snj=c3=b3fr=c3=ad=c3=b0?=ur
MIME-Version: 1.0
Message-ID: <!&!AAAAAAAAAAAYAAAAAAAAABluo5KJeUpCslhvgKM4mZnCgAAAEAAAAIGHdE3Z8MdFhGLsK9UnDgUBAAAAAA==@fookes.com>
Date: Tue, 25 Feb 2014 10:58:18 +0100
Content-Type: multipart/mixed;boundary="Next_Item:_(A3CB49KFSA19)/1"
          
Same header extracted by competing eDiscovery tool
x-store-info:sbevkl2QZR7OXo7WID5ZcVBK1Phj2jX/
Authentication-Results: hotmail.com; spf=pass (sender IP is 96.30.47.96) smtp.mailfrom=david.johnson@fookes.com; dkim=pass header.d=fookes.com; x-hmca=pass header.id=david.johnson@fookes.com
X-SID-PRA: david.johnson@fookes.com
X-AUTH-Result: PASS
X-SID-Result: PASS
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0xO0Q9MTtHRD0xO1NDTD0w
X-Message-Info: NhFq/7gR1vQRHV6jbdvQfsKUeeVAoUVojAJS6DKEC2GNUUM0G+Idi8S6bQ+yOheURPNKM+ceVA3sxGBBdP1EXLOQS4fNzCSzxNSv8LmL1zB6Ig6GoQXO4AY+byEwxgTcdu3BFpOcpQKVeZatIvi3zNJwl3djyhVsTq2RhIH+qQHVu5h8LDsU9uzF2wTW29UAon9Bseo3FpdNC8Y22VXkKMPttP2iurtq
Received: from host.fookes.com ([96.30.47.96]) by SNT0-MC2-F45.Snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
	 Tue, 25 Feb 2014 01:58:16 -0800
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=fookes.com; s=default;
	h=Content-Type:MIME-Version:Message-ID:Date:Subject:Cc:To:From; bh=JaM6HEHiGymnxtuIqtQZ1XV3kKOd0Dqhq6gZ6oaSzq0=;
	b=Nd6UJ2o9NjyP7XSxjt+6UnJ1b/l+yNXeKRoJ2ILQSSHOKG8NZ0w+97n7wcWdu9yD7wxMlzPKBHgFt3Am8GtSBYfRtcyT1Aqv4fS0/YHNsIg8BH5d5PHRr8lqJ8cLpXWMgXruP1L2dUYeDDb+UgbkHfIz+uOF0BnMyWOFKUuvV4k=;
Received: from 80-218-191-28.dclient.hispeed.ch ([23.247.123.38]:58440 helo=T3500)
	by host.fookes.com with esmtpsa (TLSv1:AES128-SHA:128)
	(Exim 4.82)
	(envelope-from <david.johnson@fookes.com>)
	id 1WIEmF-0000dK-An; Tue, 25 Feb 2014 03:58:15 -0600
Return-Receipt-To: <david.johnson@fookes.com>
From: <david.johnson@fookes.com>
To: =?iso-8859-1?B?J0rpcvRtZSBBcudvaXMn?= <jerome.arcois@fookes.com>
Cc: "'Joan Miller'" <joan.miller@fookes.com>,
	"'Susan Williams'" <susan.williams@fookes.com>,
	"'Peter Smith'" <peter.smith@fookes.com>,
	"'Eugene Fookes'" <eugene.fookes@outlook.com>
Subject: =?iso-8859-1?Q?Please_check_important_charts_from_Snj=F3fr=ED=F0ur?=
Date: Tue, 25 Feb 2014 10:58:13 +0100
Message-ID: <!&!AAAAAAAAAAAYAAAAAAAAABluo5KJeUpCslhvgKM4mZnCgAAAEAAAAIGHdE3Z8MdFhGLsK9UnDgUBAAAAAA==@fookes.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;
	boundary="----=_NextPart_000_0000_01CF3218.7BF01810"
X-Priority: 1 (Highest)
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook 14.0
Importance: High
Thread-Index: Ac8yDzP4nnZLjzY8SdeZrtR0leJ50g==
Content-Language: en-us
Disposition-Notification-To: <david.johnson@fookes.com>
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - host.fookes.com
X-AntiAbuse: Original Domain - outlook.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - fookes.com
X-Get-Message-Sender-Via: host.fookes.com: authenticated_id: david.johnson@fookes.com
X-Source:
X-Source-Args:
X-Source-Dir:
Return-Path: david.johnson@fookes.com
X-OriginalArrivalTime: 25 Feb 2014 09:58:16.0790 (UTC) FILETIME=[1AD27760:01CF3210]
Status: RO
X-Folder: Copies
          
Same email with header extracted by Aid4Mail

Output Formats for Delivering and Filing Email Data

Aid4Mail offers several export options to ease the delivery and filing of collected email data. It can convert messages to PDF or HTML to facilitate file sharing with the court and legal teams. Aid4Mail can also create PDF/A-1a (Level A Conformance) files which are being adopted by federal courts in the U.S. as the standard format for electronic filing (CM/ECF systems).

If you need to analyze or process mail further using other tools, Aid4Mail can export messages to standard Outlook PST files, mbox (formatted for Windows, Mac, or UNIX/Linux), individual EML message files, CSV (supported by Microsoft Excel and most databases), XML, and more. Custom output formats can also be created with Aid4Mail's powerful scripting capabilities.


Command-Line Option

Aid4Mail Console is a command-line edition that can be used to automate examination tasks and batch process email files and accounts. Unlike the wizard edition of Aid4Mail, the console edition can process multiple PST files unattended.

Aid4Mail Console is included in the price of Aid4Mail eDiscovery Service and is available as a bundled option with Aid4Mail Forensic.


Who Uses Aid4Mail?

Aid4Mail has many thousands of satisfied users around the world, including law enforcement and government agencies, intelligence and military organizations, law firms, large corporations and financial institutions, audit firms, as well as consultants and students of computer forensics.

And it's no wonder. Aid4Mail was developed specifically to meet the high demands of forensic and e-discovery professionals.


Here's What our Users Had to Say About Aid4Mail

“We work with over 1TB [one terabyte] of email per month and your Aid4Mail product has shown to be an integral part of our toolset for dealing with these volumes of email.”
– Jason Rappoport, USA
“Aid4Mail scripted approach took just 8 hours to finish (!), which is almost impossible to compare with 23 hours of running time for Transend. On top of everything else, it looks like that Aid4Mail-generated PST files are way smaller than Transend-generated.”
– Dragan Stankovic, Canada
“Works exactly as advertised, a rare and welcome thing these days.”
– Alan Mintaka, USA
“The product has done a fantastic job and the support has been first class.”
– Peter Hopkin, UK
“Very easy to use, and gives multiple options for output. Works with almost all the major email programs.”
– Lisa Snider, Canada

Try Aid4Mail for Free

Take advantage of our free trial and start using Aid4Mail today. There's no sign-up form to download Aid4Mail and you can run it in trial mode for as long as you need. This way you can verify that Aid4Mail is fully compatible with your computer and does what you require.

Click to download your FREE Aid4Mail trial.


Ready to Buy Now? It's Quick and Easy

Please note that you need one license per seat. The number of accounts you can process depends on which license you purchase. See the Aid4Mail End User License Agreement for details on usage conditions or the EULA Comparison Chart for a quick overview.

Aid4Mail Forensic
Primarily for Public Sector

  •  CLI console: optional (+ $299 US)
    Private Sector:
     Limited to internal mail
    Public Sector:
     Unlimited end-users mail
  •  One-Year License
     50% discount on renewal
  •  Supports MS Exchange
     Filter mail by date/keywords
     Process/restore unpurged mail
  •  Also converts to PDF/A
     Multi-seat option
     Offline license activation

Aid4Mail Service
Primarily for Private Sector

  •  CLI console: included
    Private Sector:
     Unlimited end-users mail
    Public Sector: :
     Unlimited end-users mail
  •  One-Year License
     50% discount on renewal
  •  Supports MS Exchange
     Filter mail by date/keywords
     Process/restore unpurged mail
  •  Also converts to PDF/A
     Multi-seat option
     Offline license activation

Please check if your computer meets the System Requirements before buying!

  • Operating System : Aid4Mail runs under Windows 8, 7, Vista, XP, 2000, Server 2012, 2008 and 2003 or Linux in conjunction with Wine. Both Windows 32-bit and 64-bit are supported.
    Windows NT4 / ME / 98 / 95 should work but are not officially supported.
  • Internet : Online license activation, validation, and re-activation require an internet connection (offline activation option available with Aid4Mail eDiscovery editions).
  • Hardware Requirements : 64 MB of RAM, 12 MB disk space. Pentium (or compatible) processor.

IF YOU'LL BE PROCESSING OUTLOOK/EXCHANGE:

  • Aid4Mail currently does not support the 64-bit versions of Office Outlook 2010 or 2013. But Windows 64-bit with Outlook 32-bit is fine.
  • Office Outlook (32-bit version) must be installed to process mail to or from Outlook/Exchange profiles, *.msg and *.pst files.
    If you don't have Outlook, you can use Microsoft's free 60 day trial of Office Outlook for Windows. Alternatively you can use their free standalone version of MAPI but note that it doesn't support Unicode PST files (which may be used in Outlook 2003 and later versions).
  • Aid4Mail may not be compatible with Click-to-Run installations of Outlook 2010; you will need to re-install Outlook 2010 using another method following Microsoft's instructions. This is not the case for Outlook 2013 which works fine with Aid4Mail 3.
  • If you have Outlook 98/2000 then it should be installed in Corporate/WorkGroup mode in order to process PST and MSG files. If it is installed in Internet Mail Only (IMO) mode, then only the default MAPI profile can be processed.
  • There may be compatibility issues with Outlook 97.
  • PST files from Outlook 2001 for Mac are supported, but not those from Outlook 8.x for Mac. Outlook 2011 for Mac can import PST files created by Aid4Mail.
  • Microsoft Exchange can either be processed through an Outlook/MAPI mail profile, or through the IMAP protocol in which case the Exchange server needs to be set up for IMAP access (see instructions).

Text in gray font indicates email formats that are unavailable based on your current selection.

PayPal and all major credit cards are accepted. You can also use a purchase order if you're a registered business and your order exceeds 100 USD.

Your personal license details and a printable invoice will be delivered to you by email immediately after your order is accepted.
Yes. Your order will be processed by cleverbridge via the secure SSL protocol, so your private data remains safe and confidential.
We offer big quantity discounts, but they can't be spread over multiple orders. So make sure you buy all the licenses you need now to get the best price.

You can set the quantity on the next screen after you click on the green button.
First, you get to try before you buy. There's no better guarantee than putting Aid4Mail to work on your own system before making up your mind. If Aid4Mail works for you during the trial, you can be sure it'll work when you get your license.

Second, our complete Quality Assurance Guarantee. After your purchase, if you're unhappy with Aid4Mail's performance for any reason, contact us immediately for a quick and easy resolution.
No. Like many other programs, Aid4Mail currently only works with the 32-bit edition of Outlook. Most users, even those with Windows 64-bit, have Outlook 32-bit installed.

Note that Aid4Mail is fully compatible with Windows 64-bit. See the System Requirements for more details.

P.S.

If you need a fast and accurate email forensic tool, you can trust Aid4Mail to do the job for you. Get your license now and start investigating email today, or test drive Aid4Mail for free in trial mode and see for yourself how well it works.