Aid4Mail Investigator is a sophisticated tool for collecting emails from a large variety of sources—on-premises files, remote mail servers and cloud-based service providers. It includes powerful email searching and filtering capabilities that even let you recover double-deleted emails.
Aid4Mail Investigator builds on the features of Aid4Mail Converter. It is primarily designed for use in the fields of digital forensics and eDiscovery, covering a range of legal proceedings including criminal investigations, litigation, compliance and auditing, and freedom of information requests (FOI).
Compared to Aid4Mail Converter, key features added to Aid4Mail Investigator include:
- Email filtering using a search syntax similar to Gmail and Outlook.
- Native pre-acquisition filtering of cloud-based accounts and PST files.
- Recovery of deleted emails that are no longer available in the trash folder.
- Forensic file carving to extract MIME emails from any kind of data.
- Flexible Bates stamping added to exported PDF pages as well as file names.
- Custom processing capabilities through user-developed Python scripts.
- Multiple concurrent conversions to reduce processing time.
Aid4Mail doesn’t require specialized hardware and is simple to install and run. It offers a modern user-interface with context-sensitive help available at the click of a button (and offline). The included manual is detailed and easy to understand.
Although there is a bit of a learning curve to master the more advanced features in Aid4Mail, it doesn’t take an expert to get started. Whether you are a lawyer on your first eDiscovery case or an experienced computer forensic examiner, Aid4Mail is ready to assist you in your job.
Aid4Mail Investigator clients include forensic and eDiscovery professionals, lawyers, law firms, national law-enforcement agencies, IT and data recovery services. For confidentiality reasons, we do not disclose their names.
How does it compare to other forensics tools?
First of all, Aid4Mail only deals with emails and their attachments. It can collect, find and recover mail that other forensics tools miss—Aid4Mail Investigator is an industry leader in this domain.
Secondly, Aid4Mail’s workflow is very different from eDiscovery software like FTK, Encase and Nuix. Aid4Mail’s primary job is to collect, filter and convert emails. The whole process takes a fraction of the time needed by traditional tools because:
- Once configured, the process of collecting, filtering and converting mail operates without user intervention. There is no manual review stage to interrupt the streamlined workflow.
- With no review stage, Aid4Mail doesn’t need to build search indexes. This saves a lot of time and system resources.
As a result, you can process terabytes of email data, unattended from start to finish—fast and accurately.
As mentioned above, you cannot review email data directly in Aid4Mail. However, if your collection is small enough, you can convert it with Aid4Mail to one of the following searchable formats:
- PST then review emails in Microsoft Outlook
- Mbox then review emails in Mozilla Thunderbird
- PDF then review emails in Adobe Reader
- HTML then review emails in your browser
- CSV then review emails in Microsoft Excel
- Plain text then review emails in a text editor
If you are unable to cull-down your email collection to a reasonable size, you’re better off transferring the files created with Aid4Mail into a comprehensive digital forensics product (e.g. FTK, Encase, AXIOM, etc.). In this respect, Aid4Mail is a great complement to these tools.
Next, we’ll cover the key tasks supported by Aid4Mail Investigator. Use the shortcuts below to go directly to the section that interests you:
Aid4Mail is designed to collect email from a large array of sources including local files, remote Exchange and IMAP servers, and cloud-based services like Gmail and Microsoft 365 (formerly Office 365). Aid4Mail can handle locally-stored mail accounts, mailboxes and email files, even when disconnected from their mail program. They can be stored on internal, external or networked hard drives, or on other media like DVD and USB devices, or mounted disk image files. Aid4Mail can even read mail files from Mac and Linux systems without prior format conversion.
A major benefit of Aid4Mail Investigator over Converter is that you gain access to delegate, shared and public accounts as well as hidden MS Exchange folders. These hidden folders are where Microsoft stores “Recoverable Items”—the location where “permanently” deleted emails land. In other words, this is where you can recover clues that a custodian may have tried to destroy.
During email collection, Aid4Mail is able to restore the original folder structure in target formats like PST, MSG and EML. It can also collect and preserve valuable metadata like email status information (Read, Replied, Starred) and key MAPI properties.
Aid4Mail includes a powerful forensic carving tool that can extract MIME emails from any kind of file, including:
- Uncompressed disk images (DD, E01, AFF, …)
- Forensically-extracted unallocated disk space
- Mailbox formats not officially supported
- Corrupt mail files
The carving algorithm works without relying on a file’s internal structure, the disk image’s Master File Table (MFT) or data placement markers. The only requirements for successful retrieval are:
- The email is in MIME format (even if incomplete)
- Its MIME parts are stored contiguously and sequentially
- It is not stored in a compressed or encrypted container
For more details on the types of source formats you can process, see the “Supported Mail Formats” section on our Aid4Mail Converter page.
When accessing Gmail, Microsoft 365 (formerly Office 365), MS Exchange and IMAP accounts, or PST files, you can use native pre-acquisition searching to limit the scope of collected emails. This works by filtering mail directly on the server prior to downloading. By narrowing the date range, and including specific keywords and message properties in your filtering criteria, you can significantly speed up collection and acquire a higher ratio of responsive emails.
Recover double-deleted messages
Double-deleted messages (also called unpurged mail) are emails that are no longer visible in your mail app but can be recovered with specialized software. These are typically emails that were sent to the Trash folder, then the Trash was emptied but the account was not purged (or compacted).
In cases of suspected spoliation, forensic investigators need the ability to recover double-deleted messages if available. This is where you are likely to find responsive documents.
Aid4Mail Investigator is able to recover unpurged mail from:
- IMAP accounts
- “Recoverable items” in MS Exchange accounts (like Microsoft 365 and Outlook.com)
- mbox files (including from Thunderbird)
- Apple Mail (EMLX files)
- Maildir stores
Aid4Mail can also recover mail from deleted files by searching disk images and their unallocated space—including drives that have been wiped clean by “quick” formatting.
Remote authentication made easy
Collecting email from cloud-based custodian accounts typically means you either need their login credentials or their presence at your side to perform the login. We have solved this problem by offering a free stand-alone utility called Aid4Mail Remote Authenticator. Your custodians can download it from our website and run it without installation.
Aid4Mail Remote Authenticator provides easy-to-follow instructions that help custodians fill-in their account details and login credentials. With your agreement, custodians can also set how many days they grant access to their accounts.
On completing the authentication process, an encrypted token file containing the account details is created. Your custodian sends you this file. Once you receive it, simply import it into Aid4Mail and you can securely access the custodian’s account during the valid period.
Culling down large data sets
When you’re dealing with large collections of email, you need a reliable way to filter out duplicates and irrelevant messages, and retain responsive material. The more you can cull down your data set, the less you have to review and the quicker you’ll find the “smoking gun”.
In Aid4Mail, email filtering is accomplished by our own search engine. Its search operators are very similar to the ones used in Gmail, Google Vault and Microsoft 365. Queries operate directly on extracted text and metadata using high-performance binary and string-searching algorithms. Email filtering is very fast, especially as it doesn’t need to build resource-intensive and time-consuming search indexes.
Aid4Mail’s search engine supports the following capabilities:
- Fielded searches which target specific parts of an email (sender, sent date, subject, message body, attachment metadata…)
- Boolean constructs with AND, OR and NOT.
- Comparison operators such as = (equal to), > (greater than), < (less than), <> (different from).
- Control character case and diacritic sensitivity for broader or finer keyword matching.
- Wildcard searches for easy and flexible pattern matching. This includes stemming, which will match inflectional forms of a searched word.
- Regular expressions for advanced pattern matching in words and phrases.
- Proximity searches that let you find terms that appear within a certain number of words of each other, or within the same sentence or paragraph.
- Include spelling variations and synonyms in a centralized tokenization file. These are applied across all of your project’s search queries.
- Search list files with multiple terms (thousands if necessary) that can be attached to fielded searches for comprehensive matching.
- Recursive searching through embedded objects, compound files and their metadata.
- Skip non-personal emails originating from mailing lists, forums, bulk mail and notifications.
- Skip email duplicates within the scope of each folder or across the whole account.
As Aid4Mail doesn’t integrate a review stage in its workflow, it doesn’t need search indexes. Why? Because the primary purpose of search indexes is to speed up the review process. As it takes a lot of time and system resources to build a good search index, that approach would significantly harm Aid4Mail’s processing speed.
Aid4Mail’s search engine combines the benefits of “serial search” with the flexibility of “index search”. You can search for exact phrases and phrase patterns (including special characters and stop words), but also use Boolean constructs, proximity operators, multilingual stemming, and cater for synonyms, spelling variations and common spelling mistakes.
If you need more advanced search capabilities, Aid4Mail gives you full control through Python scripting. For example, extract and search text from images using Python optical character recognition (OCR) modules or use Python image analysis to detect nudity in photos.
Email conversion for review & production
Aid4Mail is designed primarily for extracting, filtering and converting email data. It doesn’t integrate an email viewer for the eDiscovery review stage. However, like many of our users do, you can convert your culled-down email collections to a PST file for review in Microsoft Outlook.
Alternatively, you can convert emails to HTML or searchable PDF files. Both these formats render email messages faithfully and provide easy access to their attachments in native format. The HTML format provides an option to create an online viewer with email and folder selection and a metadata search bar to filter the email list.
If you are unable to sufficiently reduce your email collections for manual review, use Aid4Mail to export them to PST, .msg, mbox or .eml for ingestion into your review platform. This conversion process to near-native format is not only fast but also complete and faithful. If necessary, you can extract all attachments in their native forms and store email metadata in CSV, TSV or XML load files.
Converting emails for production
Aid4Mail provides many formats that you can use for production. For example, you can export emails to native (e.g. .msg, .eml) and searchable near-native (e.g. .pdf, .html) formats, or store fielded data and metadata in a delimited text file (e.g. .csv, .tsx, .xml). Alternatively, extract email attachments in a batch and save them in their native forms while preserving family relationships between messages and files.
When converting between email formats, Aid4Mail takes great care to preserve the integrity of header data and message content. Whenever possible, it also replicates status information (e.g. Read, Replied, Flagged) in the target format. And you have the option to restore the original folder structure.
Fully customizable Bates stamping is available to add a unique identifier to each email. You can easily insert these stamps in the pages of near-native formats like PDF and HTML. Hash values like MD5, SHA1 and FNV-1a are also available to uniquely identify emails. All these identifiers can be chosen for file naming when exporting emails to individual files like .msg, .eml and .pdf.
Aid4Mail integrates a template syntax with merge fields, giving you full control over target folder and file naming. Use it to merge, split, and reorganize mailboxes based on a large array of criteria, including project and email metadata, Bates stamps and even dates and time. A particularly unique feature even lets you group emails by account, based on the sender and recipient email addresses.
Boost processing speed even further!
Aid4Mail Investigator lets you run multiple conversions simultaneously. With the right hardware, this feature can significantly improve processing speed. These can either be totally independent conversions, or share the same source or target, or both.
For example, you can merge emails from multiple sources into a single PST file. Or split a single source file into multiple target files. Alternatively, apply multiple search criteria to a single mail store, saving the results in different folders within the same PST, all at the same time.
Try it out for free—no strings attached
There’s lots more in Aid4Mail Investigator, and the best way to discover its capabilities is to try it out. We offer a free trial version with no time limit, no forms to fill-in and no obligations. Simply visit our Downloads page to get your free trial now.
And if you would like to see a detailed feature comparison between the three Aid4Mail editions, check our Aid4Mail 5 feature comparison table in PDF format.
Flexible licensing options
Aid4Mail licenses allow you to process an unlimited number of mail accounts and files, whether in-house or external. You can purchase a one-year license, or three years at a reduced price. During the license validity period, you benefit from free software updates and our legendary customer support.
On purchasing a license, you will receive an activation code that gets you up and running with Aid4Mail within minutes of making your payment. Once activated, trial mode is turned off and your license becomes tied to your computer and Windows login account. See our EULA for details on how this works.
If you need to run Aid4Mail on a computer that doesn’t allow Internet access, simply contact us for an offline activation code. There is no charge for this option but it offers less flexibility than online activation.
We also offer licensing options for running Aid4Mail in a virtual environment. Pricing is determined by the number of concurrent users plus the total number of users and installations. Contact us for a quote.
If you’re ready to buy an Aid4Mail license, visit our Buy Now page for pricing details and links to our online store.
P.S. Make sure you also check the extra features included in Aid4Mail Enterprise. It adds the following significant features:
- Source formats: Google Vault, Mimecast and Proofpoint
- Target formats: Gmail, IMAP, Microsoft 365 and MS Exchange
- Command-line interface (CLI) to automate email processing
- Run from a server or networked computer, or a shareable USB flash drive
- Cost-effective licensing options for teams.
Why choose Aid4Mail?
We have been developing software since 1990. Our first email tool was launched in 1999 and Aid4Mail followed in 2005. So our experience in processing email data spans over two decades.
All core functionality in Aid4Mail is developed in-house. This means that key features are tightly integrated and optimized for speed. We are in full control of our code, including major components like email parsing and conversion, the filtering engine and its search syntax, MAPI access to Outlook accounts, and even the IMAP protocol used to connect with services like Yahoo! Mail and AOL.
Important clients around the world are relying on our software. These include the US government and law enforcement agencies, top law firms, national libraries, prestigious universities, major banks, and international NGOs. Currently half of the Fortune 50 companies are Aid4Mail clients and the numbers keep growing. For confidentiality reasons, we do not disclose their names.