Overview
Aid4Mail 6 introduces groundbreaking cloud attachment collection capabilities, allowing forensic investigators and eDiscovery professionals to gather modern cloud attachments from Google Drive and Microsoft platforms (OneDrive Personal, Business, and SharePoint).
Key Capabilities
Industry Terminology
Configuration
Configure cloud attachment collection through the Settings tab in Aid4Mail’s Source section.
Getting Started
- 1
Navigate to Settings Tab
Find the Source section
- 2
Enable Cloud Collection
Check “Collect cloud attachments and their metadata”
- 3
Configure Account Access
Add Microsoft or Google accounts as needed
How It Works
When enabled, Aid4Mail checks each processed email for hyperlinks pointing to cloud-stored files. The software intelligently identifies and collects these modern attachments based on your configured settings.
Note: If no account is selected, Aid4Mail will only access publicly available files.
Microsoft Accounts
Configure access to OneDrive (Personal and Business) and SharePoint files through Microsoft accounts.
Personal Accounts
Hotmail, Outlook.com
- OneDrive Personal access
- Consumer cloud storage
Work Accounts
Microsoft 365, Exchange Online
- OneDrive Business access
- SharePoint document libraries
Account Selection
The account drop-down lists all email accounts accessible via the Microsoft Graph API. If your desired account is missing, click the Add button to authenticate.
Tip: This option is hidden when you’ve already selected the Graph API as your source format.
Google Accounts
Access Google Drive files and Google Workspace documents through authenticated Google accounts.
Google Drive Features
Supported Files
- Google Docs → Word (.docx)
- Google Sheets → Excel (.xlsx)
- Google Slides → PowerPoint (.pptx)
- Google Forms → CSV
File Size Limits
Export Limitation
Google’s export limit is 10 MB. Files exceeding this won’t download.
Account Configuration
Similar to Microsoft accounts, the drop-down lists Google accounts accessible via the Google API. Click Add if you need to authenticate a new account. This field is hidden when Gmail is selected as the source format.
Document Revision Matching
Aid4Mail can retrieve the exact version of a document that existed when an email was sent—crucial for establishing what information was shared at specific points in time.
How Revision Matching Works
When enabled, Aid4Mail downloads document versions with timestamps matching the email send date. Revision numbers are appended to filenames in square brackets.
Example: MyFile [59].docx
Important Considerations
- • Cloud providers send notifications for each document revision
- • Heavily edited documents can generate hundreds of versions
- • This can significantly increase processing time
- • May trigger bandwidth throttling from cloud providers
- • Results in multiple versions of the same document
Filtering Revision Notifications
To exclude Google Docs revision notifications, use this filter:
NOT From:comments-noreply@docs.google.com Warning: This filter assumes the original document link was sent in a regular email. If it was only shared through automated notifications, this filter would prevent any collection of the document.
Recommendations for Efficient Collection
Optimize your cloud attachment collection while minimizing bandwidth usage and processing time.
Filter Early
Use pre-acquisition and local filters to limit email collection. Narrow scope to relevant time periods, contacts, and exclude irrelevant folders and labels.
Minimize Revisions
Only download document revisions when necessary. Consider using the latest version with revision notification searches.
Limit File Sizes
Modern attachments can be up to 5 TB in Google Drive. Use Aid4Mail’s file size limits to prevent downloading unnecessarily large files.
Use Incremental Processing
If interrupted, Aid4Mail allows you to resume collection without starting over, saving significant time.
Export First with Google Vault
When possible, avoid Google’s bandwidth limitations by exporting through Vault first. Ensure linked Drive files are included in your export.
Pro Tip
We recommend leaving “Match document revision” unchecked and not filtering out notifications. Aid4Mail will download the latest version of each document, and you can still access revision details from notification emails.
CSV File with Metadata
Aid4Mail saves comprehensive cloud attachment metadata in a CSV file named FileMetadata.csv, providing detailed information about each collected file.
Metadata Columns
User Information
Author- File creatorCollaborators- Edit accessViewers- View access
Timestamps
DateCreated- Creation time (UTC)DateModified- Last modified (UTC)
File Properties
DocId- Document identifierFileName- File nameFileSize- Size in bytesMimeType- File typeTitle- Document title
Links & Versions
DownloadLink- Direct URLHyperlink- Email linkVersion- Revision ID
Status Values
Success States
File found- Metadata collectedFile saved- Successfully downloaded
Error States
File not found- 404 errorForbidden- 403 insufficient permissionsUnauthorized- 401 invalid credentialsFile unavailable- 429 temporarily unavailableSave error- Error while saving