Overview
Aid4Mail 6 Investigator and Enterprise collect modern cloud attachments—files hyperlinked from an email but hosted by a cloud-service provider—from Google Drive and Microsoft OneDrive (Personal, Business, and SharePoint), including document revisions. This lets forensic investigators and eDiscovery professionals capture linked-file content and metadata that link-only email exports omit.
Edition availability: Cloud attachment collection is available in Aid4Mail Investigator and Enterprise. It is not included in Aid4Mail Converter.
Key Capabilities
Industry Terminology
Configuration
Configure cloud attachment collection through the Settings tab in Aid4Mail’s Source section.
Getting Started
- 1
Navigate to the Settings Tab
Find the Source section
- 2
Enable Cloud Collection
Check “Collect cloud attachments and their metadata”
- 3
Configure Account Access
Add Microsoft or Google accounts as needed
How It Works
When enabled, Aid4Mail checks each processed email for hyperlinks pointing to cloud-hosted files. It scans the message body—after converting it to plain text—regardless of the source email format (for example, PST, OST, MSG, OLM, mbox, EML, Maildir, or EMLX). Aid4Mail does not scan the contents of traditional attachments, so a cloud link contained only inside an attached message or document is not detected.
Note: If no account is selected, Aid4Mail accesses only publicly available files.
File Collection Size
Use the Collect files up to drop-down (Source section) to control how much Aid4Mail downloads:
- Only metadata — records metadata without downloading files; supports data-minimization goals.
- No limit — downloads files of any size the provider allows.
- 10 MB to 500 MB — a fixed size cap.
Aid4Mail records metadata for every file it finds, in all modes.
Where Files Are Saved
Set Cloud attachment location under the Target section to choose where Aid4Mail saves downloaded files and the FileMetadata.csv report.
Microsoft Accounts
Configure access to OneDrive (Personal and Business) and SharePoint files through Microsoft accounts.
Personal Accounts
Hotmail, Outlook.com
- OneDrive Personal access only
- Consumer cloud storage
Work Accounts
Microsoft 365, Exchange Online
- OneDrive Business access
- SharePoint document libraries
Account Selection
The account drop-down lists all email accounts accessible via the Microsoft Graph API. If your desired account is missing, click the Add button to authenticate. Aid4Mail then uses the selected account’s credentials to download files from OneDrive and SharePoint.
Tip: This option is hidden when you’ve already selected the Graph API as your source format.
Google Accounts
Access Google Drive files and Google Workspace documents through authenticated Google accounts.
Google Drive Features
Workspace Export Formats
- Google Docs → Word (.docx)
- Google Sheets → Excel (.xlsx)
- Google Slides → PowerPoint (.pptx)
- Google Forms → CSV
Export Size Limit
Workspace exports only
When Aid4Mail exports native Google formats (Docs, Sheets, Slides, and Forms), Google’s export limit is 10 MB—files exceeding this won’t download. This limit is separate from Aid4Mail’s own Collect files up to setting.
Account Configuration
Similar to Microsoft accounts, the drop-down lists Google accounts accessible via the Google API. Click Add if you need to authenticate a new account. Aid4Mail uses the selected account’s credentials to download hyperlinked files from Google Drive. This field is hidden when Gmail is selected as the source format.
Authentication & Access
Aid4Mail signs in to cloud accounts through OAuth 2.1. Several options let you collect from accounts beyond your own.
OAuth 2.1 Sign-In
Aid4Mail authenticates to Microsoft and Google accounts using OAuth 2.1, so credentials are never stored in the project.
Microsoft 365 App-Only Access
App-Only Access enables tenant-wide collection of linked attachments without individual user credentials.
Aid4Mail Remote Authenticator
To collect from an account you do not control, the Remote Authenticator lets the custodian grant consent.
Verified Google App
Aid4Mail has completed Google’s OAuth app verification for the Gmail and Google Drive scopes required to collect messages and linked Drive files.
Document Revision Matching
Aid4Mail can retrieve the version of a document that was current when an email was sent—useful for establishing what was shared at a specific point in time. This returns a single as-sent version per email, not a full revision history.
Off by default. With Match document revision turned off, Aid4Mail downloads one version of each document: the latest available at the time of collection.
How Revision Matching Works
When Match document revision is enabled, Aid4Mail retrieves the document version that was current when the email was sent and appends the version number in square brackets to the file name.
Example: MyFile [59].docx
Important Considerations
- • Cloud providers email a notification whenever a document is shared or updated.
- • Google notifies for every batch of edits or comments; Microsoft notifies for comments only, not edits alone. Both notify on the initial share.
- • With matching on, Aid4Mail treats each revision as current for its notification email and downloads all of them.
- • Heavily edited or frequently commented documents can generate hundreds of revisions.
- • This increases processing time, can trigger bandwidth throttling, and produces many versions of the same document.
Filtering Revision Notifications
To exclude Google Docs edit and comment notifications, use this filter:
NOT From:comments-noreply@docs.google.com Warning: This filter assumes the original document link was sent in a regular email. If the link was shared only through an automated notification, this filter would prevent any collection of that document.
Recommendations for Efficient Collection
Optimize your cloud attachment collection while minimizing bandwidth usage and processing time.
Filter Early
Use native pre-acquisition (server-side) and local filters to limit collection. Narrow scope to relevant time periods and contacts, and exclude irrelevant folders and labels. Note that native pre-acquisition filtering cannot be combined with incremental processing in the same session.
Minimize Revisions
Only download document revisions when the as-sent version is required. Otherwise, use the latest version together with searches of the revision notifications.
Limit File Sizes
Modern attachments can be up to 5 TB in Google Drive. Use the Collect files up to setting to cap downloads, or choose Only metadata to skip downloads entirely.
Use Incremental Processing
If interrupted, Aid4Mail can resume collection without starting over. Incremental processing and native pre-acquisition filtering are mutually exclusive within a session, so choose one; local (post-acquisition) filtering works with either.
Export First with Google Vault
When possible, export mail through Google Vault first to avoid Google’s bandwidth limits and throttling, and to let Aid4Mail process files locally and faster. Include linked Drive files in the export. With a Vault export, turn off Collect cloud attachments and their metadata unless you also need to collect Microsoft cloud attachments.
Pro Tip
We recommend leaving Match document revision unchecked and not filtering out notifications. Aid4Mail will download the latest version of each document, and you can still access earlier edits and comments from the revision notification emails.
CSV File with Metadata
Aid4Mail saves cloud attachment metadata in a CSV file named FileMetadata.csv, written to the Cloud attachment location folder (Target section). The file contains 17 columns, listed here by theme.
Metadata Columns
User Access (email addresses)
Author- File creatorCollaborators- Edit accessViewers- View access
Timestamps (UTC)
DateCreated- Creation timeDateModified- Last modifiedEmailDate- Parent email sent date
File Properties
DocId- Document identifierFileName- File nameFileSize- Size in bytesMimeType- File typeTitle- Document titleSource- Location (Google Vault, Google Drive, OneDrive, SharePoint)
Links & Parent Email
DownloadLink- Download URLHyperlink- Link from the emailVersion- Revision/version IDEmailId- Parent email’s EDRM MIH+ value
Forensic linkage: EmailId holds the parent email’s EDRM MIH+ value, preserving the connection between each collected file and the email it came from. DownloadLink is populated for versioned documents and for files that do not require credentials.
Status Values
The Status column records the result for each file (it is empty when none applies).
Success States
File found- Accessible; metadata collectedFile saved- Downloaded and saved
Error & Exception States
File inaccessible- Metadata could not be retrievedFile not found- HTTP 404File unavailable- HTTP 429, temporarily unavailableForbidden- HTTP 403, insufficient permissionsUnauthorized- HTTP 401, invalid credentialsHTTP error- Above 299, excluding 401, 403, 404, and 429Save error- File found, but an error occurred while savingUnzip error- Corrupted ZIP container from a Google Vault local attachment
Searching Collected Attachments
Both the collected files and their metadata are searchable through the Aid4Mail filter script. Use these operators to target cloud attachments.
-
Has:CloudAttachmentMatches any cloud attachment. Equivalent to
Has:GoogleDrive|OneDrive|SharePoint. -
Has:SharePointMatches OneDrive Business and SharePoint links.
-
Has:AttachmentMatches traditional attachments only.
-
Has:Attachment|CloudAttachmentMatches either traditional or cloud attachments.
AI Analysis of Collected Attachments
Collected cloud attachments can feed Aid4Mail’s AI tasks (Filter, Classify, and Analyze). Enable Include attachment data under Project Settings, in the AI section, to add extracted attachment text to the AI payload.
- • Requires the file to be downloaded, so it does not apply in metadata-only mode.
- • Aid4Mail does not perform OCR and does not extract encrypted or password-protected files.
- • Cloud-attachment filenames are always included in the AI payload, even in metadata-only mode.
- • The Attachment text size limit bounds the extracted text. Because the combined payload can exceed the model’s context window, validate the setting on a representative sample before processing at scale.
For details, see the Aid4Mail AI guide.