Advanced Email Forensics Powered by AI
Cloud & Offline AI Email Classification and Analysis
Go beyond keywords with contextual AI analysis. Cut collection time by up to 90%, recover deleted evidence, and collect cloud attachments with metadata. AI is optional—every forensic, search, and recovery tool works without it.
Why Forensics Teams Choose Investigator
Cloud and offline AI Integration
Natural language filtering & classification
Pre-Acquisition Filtering
Cut collection time by up to 90% at source
Complete Evidence Recovery
Find double-deleted & carved emails
Cloud Attachment Collection
Capture OneDrive & Google Drive files
Everything in Aid4Mail Converter, Included
Investigator builds on the complete Converter toolkit—then adds the forensic, AI, and eDiscovery capabilities below.
The Converter Foundation
Every conversion and migration capability carries over to Investigator.
- 40+ email formats—read Outlook PST/OST/MSG and Apple Mail OLM/EMLX directly, without Outlook or Mac
- Microsoft 365 organization-wide collection with App-Only Access—no individual user sign-ins
- All-in-one unattended workflow, from collection through export
- Portable, zero-install Email Viewer with search and tagging
- Incremental, resumable processing and journaling-envelope removal
- Full accessibility—keyboard navigation, screen readers, high-contrast mode, and UI zoom up to 150%
Move Beyond Traditional Keyword Searches
Modern investigations demand modern tools. Stop missing critical evidence hidden in context, foreign languages, and coded communications.
Traditional Tools
- ⯈ Download entire mailboxes first
- ⯈ Limited to keyword searches
- ⯈ Miss coded language & context
- ⯈ Partial access cloud attachments
- ⯈ Slow, manual review process
With Aid4Mail Investigator
- ⯈ Filter before downloading (up to 90% less)
- ⯈ AI understands context & meaning
- ⯈ Interprets coded language and translates foreign text
- ⯈ Collects cloud files with metadata
- ⯈ Automated AI classification
Published studies put keyword search recall at just 20–40%—it misses 60–80% of responsive emails. Aid4Mail’s AI classifies on meaning, not exact strings, so it doesn’t share that blind spot.
Advanced Forensics Capabilities
Everything you need for complex investigations, from AI analysis to deleted email recovery.
AI-Powered Analysis
Forensics tool with integrated cloud and offline AI. Use natural language to filter, classify, and analyze emails contextually.
- Natural language filtering
- Auto-classification (Responsive/Privileged)
- Multi-language translation
- Offline AI with model choice
Pre-Acquisition Filtering
Native server-side filtering (KQL, Gmail operators, IMAP SEARCH) downloads only matching messages—cutting collection time by up to 90%.
- Date, sender, subject & keyword filters
- Native KQL / Gmail / IMAP syntax
- Supports GDPR data minimization
- Bandwidth & storage savings
Cloud Attachments
Collect linked OneDrive, SharePoint, and Google Drive files with detailed metadata.
- Document as sent, or latest version
- Metadata preservation
- Access permissions
- Automatic format conversion
Deleted Email Recovery
Restore double-deleted emails from IMAP, mbox, Exchange Recoverable Items, and PST/OST files (no Outlook required) that suspects think are gone.
- Unpurged mail restoration
- Corrupted file recovery
- IMAP, PST & OST recovery
- Exchange Recoverable Items recovery
Email Carving
Extract emails from unallocated space, disk images (DD, E01, AFF), and corrupted files that standard collection misses.
- MIME carving from raw media
- Unallocated & slack space
- DD, E01, AFF disk images
- Partial email recovery
Advanced Search
Boolean, regex, proximity, and 24-language stemming—plus deep text search inside attachments and archives.
- Gmail / M365 filter syntax
- PCRE2 regex & wildcards
- Attachment & archive text search
- Multimedia metadata (ExifTool)
Python Scripting
Automate forensic tasks with 10 ready-to-run Python scripts—each documented with a PDF guide, and configurable without writing code.
- Attachment Risk Scoring
- Evidence Integrity Verification
- Entity extraction & cataloguing
- Relationship Mapper
Concurrent Processing
Run multiple sessions at once—a single command processes an entire queued project unattended, up to 16 at a time.
- Parallel session processing
- Run All / Run Checked queue
- Process multiple custodians at once
- Up to ~5× faster wall-clock (internal test with 8 concurrent sessions)
Proven recovery. In an internal test, Aid4Mail recovered all 100 deleted and partially corrupted MIME messages from a disk image, while two leading forensic tools returned only unusable fragments. Scoped to email/MIME recovery—not a general carving comparison.
No coding required. All 10 bundled scripts are configurable without programming, and the free Aid4Mail Python Script Generator turns plain-English descriptions into filter and modifier scripts. It’s a public ChatGPT tool, separate from Aid4Mail’s in-product AI—review and test its output before use.
Transform Investigations with AI Intelligence
Stop searching for words. Start understanding meaning.
Natural Language Filtering
Describe what you’re looking for in plain English
- ⯈ "Find emails discussing suspicious financial transactions"
- ⯈ "Identify threats or intimidation, even if coded"
- ⯈ "Locate privileged attorney-client communications"
Automatic Classification
AI sorts emails into investigative categories
- Responsive vs. Non-responsive for discovery
- Privileged communications for protection
- Custom categories: Harassment, Bribery, Fraud
Analyze & Extract
Turn raw evidence into review-ready intelligence
- Summarize long threads and attachments
- Translate foreign-language messages
- Extract names, dates, and entities
Flexible AI Deployment Options
Choose the right security model for your investigation
- Cloud AI: bring your own key for frontier models from Anthropic, Google, OpenAI, and more—billed by the provider, not bundled into your subscription
- Enterprise Platforms: deploy on Microsoft Foundry, the Gemini Enterprise Agent Platform, or Amazon Bedrock
- Offline AI: run models on-premises through Ollama or LM Studio—data never leaves your network, with no per-use API cost
Benchmarked Accuracy You Can Reproduce
We evaluated 42 AI models and retained 11. The full test kit and corpus are downloadable, so you can verify the numbers on your own model and hardware—not take our word for it.
Every classification returns Responsive, INCONCLUSIVE, or Unresponsive—the model flags genuinely ambiguous emails for human review instead of forcing a decision, and each run can be archived for a defensible record.
May 2026 benchmark snapshot on a 2,000-email insider-threat corpus (real Podesta emails with a synthetic responsive set). Recall is the headline metric; results depend on prevalence, prompt quality, corpus, and model fit, and AI classification is stable but not bit-identical across runs. Cloud models are bring-your-own-key—around $45 per 100,000 emails on the lowest-cost model; offline models add no per-use cost after hardware.
The Complete Investigation Workflow
From targeted collection to defensible production—all automated.
Pre-Acquisition Filtering
Connect to Microsoft 365, Gmail, or IMAP. Apply date, keyword, and custodian filters server-side.
Up to 90% Reduction: Download only matching data from the start
Advanced Collection
Collect filtered emails, cloud attachments with metadata, and recover deleted messages automatically.
Complete Evidence: Including data other tools miss
AI Analysis & Classification
Apply 200+ built-in prompts across forensics, eDiscovery, and FOIA—or your own plain-English instructions—to filter, classify, and extract intelligence.
Faster review: AI triage accelerates review without slow manual keyword passes
Production & Export
Export to PST, PDF with Bates stamps, or the portable, zero-install Email Viewer. Once pre- and post-acquisition filtering and AI have culled the set, reviewers get a lean, searchable package that opens without installing anything.
Defensible: Audit-logged with EDRM MIH+ IDs for chain of custody
Built for Complex Investigations
Trusted by law enforcement, government agencies, and Fortune 500 companies.
Corporate Investigations
- AI-detect financial misconduct patterns
- Identify privileged communications
- GDPR-ready targeted collection
- Surface potential FCPA issues with AI
Criminal Investigations
- Recover deleted evidence
- Carve emails from disk images
- Track communication patterns
- Multi-language translation
eDiscovery & Litigation
- Pre-cull before review platforms
- Auto-classify responsive documents
- EDRM MIH+ IDs & metadata integrity
- Bates stamping & production
HR & Workplace Issues
- AI-identify harassment patterns
- Detect policy violations
- Maintain confidentiality
- Quick targeted searches
Incident Response
- Trace phishing campaigns
- Identify compromised accounts
- Track lateral movement
- Rapid evidence collection
Government & FOIA
- Automated FOIA compliance
- Redaction preparation
- Audit trail maintenance
- Offline AI for classified data
Scale Up with Enterprise for Teams
When your team needs unlimited users, automation, and enterprise archive support.
Edition Comparison
| Feature | Investigator | Enterprise |
|---|---|---|
| AI-Powered Analysis | | |
| Pre-Acquisition Filtering | | |
| Cloud Attachment Collection | | |
| Email Recovery & Carving | | |
| Command-Line Automation | | |
| Mimecast Archive Support | | |
| Proofpoint Archive Support | | |
| Number of Users | Single User | Unlimited Internal Users |
| Deployment Options | Single Computer | Server, Network, or USB |
Aid4Mail Investigator
Advanced forensics & eDiscovery
- Everything in Converter, plus:
- AI classification & analysis
- Pre- & post-acquisition filtering
- Cloud attachments & metadata
- Double-deleted email recovery
- Email carving from disk images
Aid4Mail Enterprise
Unlimited teams & automation
- Everything in Investigator, plus:
- Unlimited internal users
- Server or USB deployment
- Command-line automation
- Mimecast & Proofpoint support
- Priority support
Why Teams Choose Enterprise
For agencies and corporations with multiple investigators, Enterprise delivers cost savings and operational flexibility that scale with your team.
- Cost-effective at scale: Break-even at 5 users, with savings growing as your team expands
- Simplified license management: One Enterprise license replaces multiple Investigator licenses
- Flexible deployment: Install on a central server, share via network, or use a portable USB key
- Full automation: CLI enables customized processing and integration with other tools
- Enterprise archives: Process Mimecast and Proofpoint exports
Used by investigation teams in government, law, and enterprise
Since 2005
Industry pioneer
FBI & DOJ
Government trusted
Fortune 500
Enterprise proven
AI integration
Cloud & Offline
Ready to Transform Your Email Investigations?
Experience the power of AI-driven forensics with Aid4Mail Investigator. Download the free trial and see why investigation teams worldwide trust Aid4Mail.