Email Forensics

Email Forensic Software that is Fast, Accurate, and User-Friendly

Aid4Mail is a fast, accurate, and easy-to-learn email forensics software solution. Over the years, it has become an essential tool for computer forensics and e-discovery professionals around the world.

Aid4Mail supports over 40 email formats and mail client programs, as well as many popular webmail services and remote accounts through IMAP. As a result, you’ll be able to process just about any type of mailbox that comes your way.

Local mail folders and files can easily be processed when disconnected from their email client, including those stored on external hard drives and media like DVD and USB devices. Aid4Mail can read mbox files from Mac and Linux systems without prior conversion.

What Can You Expect With Aid4Mail?

Here are some of the benefits you'll get with Aid4Mail:

  • Dependable, with results that are more accurate than other solutions.
  • Easy-to-learn interface and context-sensitive help to make your job easier.
  • Saves time with its fast email processing engine and de-duping features.
  • Finds relevant information, thanks to its powerful search features.
  • Good value for money, with prices as low as $299 US.

But that’s not all. Aid4Mail integrates accessibility features making it Section 508 compliant. This means it fulfills the necessary requirements for use in U.S. government agencies.

Aid4Mail’s user-friendly wizard interface
Aid4Mail’s user-friendly wizard interface

Accurate Email Data Acquisition

Aid4Mail easily handles very large messages and attachments, and huge mailbox files. It often succeeds in extracting mail from corrupt mailboxes and fixing malformed emails. Aid4Mail can also restore deleted and unpurged emails from many mailbox formats and IMAP mail accounts.

Aid4Mail is one of the most accurate tools on the market when it comes to rebuilding mail. When programs like Outlook and Eudora receive an email, they alter and split it prior to saving in the mail store. Traditional forensics tools are often incapable of correctly putting the pieces back together. As a result, collected data is incomplete and searches miss relevant chunks of data.

Email after conversion with a competing tool
Email after conversion with a competing tool
Same email converted with Aid4Mail
Same email converted with Aid4Mail

Aid4Mail can rebuild emails, producing a format that is as faithful as possible with the original RFC message. Source metadata like SMTP header fields are recovered, status information and dates restored, and attachments and embedded contents copied back into the email. Example using a competing product, followed by Aid4Mail:

From: "david.johnson@fookes.com" <david.johnson@fookes.com>
To: "'J=?UTF-8?Q?=c3=a9r=c3=b4me=20Ar=c3=a7?=ois'" <jerome.arcois@fookes.com>
cc: "'Joan Miller'" <joan.miller@fookes.com>
cc: "'Susan Williams'" <susan.williams@fookes.com>
cc: "'Peter Smith'" <peter.smith@fookes.com>
cc: "'Eugene Fookes'" <eugene.fookes@outlook.com>
Importance: High
X-Mozilla-Status: 0001
Subject: Please=?UTF-8?Q?=20check=20important=20charts=20from=20Snj=c3=b3fr=c3=ad=c3=b0?=ur
MIME-Version: 1.0
Message-ID: <!&!AAAAAAAAAAAYAAAAAAAAABluo5KJeUpCslhvgKM4mZnCgAAAEAAAAIGHdE3Z8MdFhGLsK9UnDgUBAAAAAA==@fookes.com>
Date: Tue, 25 Feb 2014 10:58:18 +0100
Content-Type: multipart/mixed;boundary="Next_Item:_(A3CB49KFSA19)/1"
				
Email header extracted by a competing forensic tool
x-store-info:sbevkl2QZR7OXo7WID5ZcVBK1Phj2jX/
Authentication-Results: hotmail.com; spf=pass (sender IP is 96.30.47.96) smtp.mailfrom=david.johnson@fookes.com; dkim=pass header.d=fookes.com; x-hmca=pass header.id=david.johnson@fookes.com
X-SID-PRA: david.johnson@fookes.com
X-AUTH-Result: PASS
X-SID-Result: PASS
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0xO0Q9MTtHRD0xO1NDTD0w
X-Message-Info: NhFq/7gR1vQRHV6jbdvQfsKUeeVAoUVojAJS6DKEC2GNUUM0G+Idi8S6bQ+yOheURPNKM+ceVA3sxGBBdP1EXLOQS4fNzCSzxNSv8LmL1zB6Ig6GoQXO4AY+byEwxgTcdu3BFpOcpQKVeZatIvi3zNJwl3djyhVsTq2RhIH+qQHVu5h8LDsU9uzF2wTW29UAon9Bseo3FpdNC8Y22VXkKMPttP2iurtq
Received: from host.fookes.com ([96.30.47.96]) by SNT0-MC2-F45.Snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
	 Tue, 25 Feb 2014 01:58:16 -0800
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=fookes.com; s=default;
	h=Content-Type:MIME-Version:Message-ID:Date:Subject:Cc:To:From; bh=JaM6HEHiGymnxtuIqtQZ1XV3kKOd0Dqhq6gZ6oaSzq0=;
	b=Nd6UJ2o9NjyP7XSxjt+6UnJ1b/l+yNXeKRoJ2ILQSSHOKG8NZ0w+97n7wcWdu9yD7wxMlzPKBHgFt3Am8GtSBYfRtcyT1Aqv4fS0/YHNsIg8BH5d5PHRr8lqJ8cLpXWMgXruP1L2dUYeDDb+UgbkHfIz+uOF0BnMyWOFKUuvV4k=;
Received: from 80-218-191-28.dclient.hispeed.ch ([23.247.123.38]:58440 helo=T3500)
	by host.fookes.com with esmtpsa (TLSv1:AES128-SHA:128)
	(Exim 4.82)
	(envelope-from <david.johnson@fookes.com>)
	id 1WIEmF-0000dK-An; Tue, 25 Feb 2014 03:58:15 -0600
Return-Receipt-To: <david.johnson@fookes.com>
From: <david.johnson@fookes.com>
To: =?iso-8859-1?B?J0rpcvRtZSBBcudvaXMn?= <jerome.arcois@fookes.com>
Cc: "'Joan Miller'" <joan.miller@fookes.com>,
	"'Susan Williams'" <susan.williams@fookes.com>,
	"'Peter Smith'" <peter.smith@fookes.com>,
	"'Eugene Fookes'" <eugene.fookes@outlook.com>
Subject: =?iso-8859-1?Q?Please_check_important_charts_from_Snj=F3fr=ED=F0ur?=
Date: Tue, 25 Feb 2014 10:58:13 +0100
Message-ID: <!&!AAAAAAAAAAAYAAAAAAAAABluo5KJeUpCslhvgKM4mZnCgAAAEAAAAIGHdE3Z8MdFhGLsK9UnDgUBAAAAAA==@fookes.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;
	boundary="----=_NextPart_000_0000_01CF3218.7BF01810"
X-Priority: 1 (Highest)
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook 14.0
Importance: High
Thread-Index: Ac8yDzP4nnZLjzY8SdeZrtR0leJ50g==
Content-Language: en-us
Disposition-Notification-To: <david.johnson@fookes.com>
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - host.fookes.com
X-AntiAbuse: Original Domain - outlook.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - fookes.com
X-Get-Message-Sender-Via: host.fookes.com: authenticated_id: david.johnson@fookes.com
X-Source:
X-Source-Args:
X-Source-Dir:
Return-Path: david.johnson@fookes.com
X-OriginalArrivalTime: 25 Feb 2014 09:58:16.0790 (UTC) FILETIME=[1AD27760:01CF3210]
Status: RO
X-Folder: Copies
				
Same email with header extracted by Aid4Mail

Output Formats for Delivering and Filing Email Data

Aid4Mail offers several export options to ease the delivery and filing of collected email data. It can convert messages to PDF or HTML to facilitate file sharing with the court and legal teams. Aid4Mail can also create PDF/A-1a (Level A Conformance) files which are being adopted by federal courts in the U.S. as the standard format for electronic filing (CM/ECF systems).

If you need to analyze or process mail further using other tools, Aid4Mail can export messages to standard Outlook PST files, mbox (formatted for Windows, Mac, or UNIX/Linux), individual EML message files, CSV (supported by Microsoft Excel and most databases), XML, and more. Custom output formats can also be created with Aid4Mail’s powerful scripting capabilities.

Command-Line Option

Aid4Mail Console is a command-line edition that can be used to automate examination tasks and batch process email files and accounts. Unlike the wizard edition of Aid4Mail, the console edition can process multiple PST files unattended.

Aid4Mail Console is included in the price of Aid4Mail eDiscovery Service and is available as a bundled option with Aid4Mail Forensic.

Who Uses Aid4Mail?

Aid4Mail has many thousands of satisfied users around the world, including law enforcement and government agencies, intelligence and military organizations, law firms, large corporations and financial institutions, audit firms, as well as consultants and students of computer forensics.

And it’s no wonder. Aid4Mail was developed specifically to meet the high demands of forensic and e-discovery professionals.

Here’s What our Users Had to Say About Aid4Mail

“We work with over 1TB [one terabyte] of email per month and your Aid4Mail product has shown to be an integral part of our toolset for dealing with these volumes of email.”
– Jason Rappoport, USA
“Aid4Mail scripted approach took just 8 hours to finish (!), which is almost impossible to compare with 23 hours of running time for Transend. On top of everything else, it looks like that Aid4Mail-generated PST files are way smaller than Transend-generated.”
– Dragan Stankovic, Canada
“Works exactly as advertised, a rare and welcome thing these days.”
– Alan Mintaka, USA
“The product has done a fantastic job and the support has been first class.”
– Peter Hopkin, UK
“Very easy to use, and gives multiple options for output. Works with almost all the major email programs.”
– Lisa Snider, Canada

Try Aid4Mail for Free

Take advantage of our free trial and start using Aid4Mail today. There’s no sign-up form to download Aid4Mail and you can run it in trial mode for as long as you need. This way you can verify that Aid4Mail is fully compatible with your computer and does what you require.

Ready to Buy Now? It’s Quick and Easy

Please note that you need one license per seat. The number of accounts you can process depends on which license you purchase. See the Aid4Mail End User License Agreement for details on usage conditions or the EULA Comparison Chart for a quick overview.

Aid4Mail Forensic
Primarily for Public Sector

$299 US

  • CLI console: optional ($299 US)
  • Public Sector:
    Unlimited end-users mail
    Private Sector:
    Limited to internal mail
  • One-Year License
    50% discount on renewal
  • Supports MS Exchange 
    Filter mail by date/keywords
    Process/restore unpurged mail 
    Also converts to PDF/A
    Offline license activation 

Aid4Mail Service
Primarily for Private Sector

$1,499 US

  • CLI console: included
  • Public Sector:
    Unlimited end-users mail
    Private Sector:
    Unlimited end-users mail
  • One-Year License
    50% discount on renewal
  • Supports MS Exchange 
    Filter mail by date/keywords
    Process/restore unpurged mail 
    Also converts to PDF/A
    Offline license activation 

Please check if your computer meets the System Requirements before buying!

  • Operating System: Aid4Mail runs under Windows 8, 7, Vista, XP, 2000, Server 2012, 2008 and 2003 or Linux in conjunction with Wine. Both Windows 32-bit and 64-bit are supported.
    Windows NT4 / ME / 98 / 95 should work but are not officially supported.
  • Hardware Requirements: 64 MB of RAM, 12 MB disk space. Pentium (or compatible) processor.
  • Internet: Online license activation, validation, and re-activation require an internet connection (offline activation option available with Aid4Mail eDiscovery editions).
  • Software Requirements: Office Outlook (32-bit version) must be installed to process mail to or from Outlook/Exchange profiles, *.msg and *.pst files.
    If you don’t have Outlook, you can use Microsoft’s free 60 day trial of Office Outlook for Windows. Alternatively you can use their free standalone version of MAPI but note that it doesn’t support Unicode PST files (which may be used in Outlook 2003 and later versions).

    Note:
    • Aid4Mail currently does not support the 64-bit versions of Office Outlook 2010 or 2013. But Windows 64-bit with Outlook 32-bit is fine.
    • Aid4Mail may not be compatible with Click-to-Run installations of Outlook 2010; you will need to re-install Outlook 2010 using another method following Microsoft’s instructions. This is not the case for Outlook 2013 which works fine with Aid4Mail 3.
    • If you have Outlook 98/2000 then it should be installed in Corporate/WorkGroup mode in order to process PST and MSG files. If it is installed in Internet Mail Only (IMO) mode, then only the default MAPI profile can be processed.
    • There may be compatibility issues with Outlook 97.
    • PST files from Outlook 2001 for Mac are supported, but not those from Outlook 8.x for Mac. Outlook 2011 for Mac can import PST files created by Aid4Mail.
  • Microsoft Exchange can either be processed through an Outlook/MAPI mail profile, or through the IMAP protocol in which case the Exchange server needs to be set up for IMAP access (see instructions).

« Back to Main Tab

Text in gray font indicates email formats that are unavailable based on your current selection.

« Back to Main Tab

P.S.

If you need a fast and accurate email forensic tool, you can trust Aid4Mail to do the job for you. Get your license now and start investigating email today, or test drive Aid4Mail for free in trial mode and see for yourself how well it works.