Email forensics & e-discovery

Aid4Mail has been optimized for speed and can work through terabytes of data without user-intervention. In tests with locally-stored files, Aid4Mail performed 6 to 10 times faster than any of its competitors!

With Aid4Mail Investigator and Aid4Mail Enterprise, you can run multiple processing tasks simultaneously, taking full advantage of your computer’s hardware and saving more time. For example, four tasks may all use the same input but different filters, and output to separate folders within the same PST file. All four tasks could be run concurrently, and unattended, while you’re working on something else. This example is shown in the screenshot below.

Alternatively, collect multiple source formats from a custodian simultaneously. For example, their Microsoft 365 account, Gmail account, local Thunderbird files and old EML files, merging them to the same batch of target PST files. Set the project up and let it run overnight so no time is wasted.

Collecting email from your custodians’ cloud-based accounts is made easy with Aid4Mail Remote Authenticator, a free stand-alone utility that they can download and run without installation. It enables the account owner to grant Aid4Mail secure, temporary access to their email service or IMAP account without providing full login credentials and without having a copy of Aid4Mail.

Maintaining the integrity of email, after conversion from one format to another, is crucial to avoid spoliation of evidence. Aid4Mail’s email conversion engine is the most accurate on the market. It is fully Unicode-compatible and preserves more data, visible and hidden, than any of its competitors.

Visible data:

• To, From, Date and Subject fields
• Status information (Read, Replied, Starred, etc.)
• Message text
• Message formatting
• Diacritical marks / accented characters (like é, ô and ç)
• Non-Latin characters (for example 你好)
• Embedded images and other media
• Attachments and their filenames
• Folder/label hierarchy

Hidden data:

• Metadata in the email header
• Server relay information
• Digital signing

Here’s an example of how much better Aid4Mail performs with visible data. Notice that it has no problem with the accented characters in the first line, the embedded image or the Chinese attachment name at the bottom.

The next example shows Aid4Mail’s superiority with hidden data. Notice how much more metadata in the email SMTP header is preserved by Aid4Mail:

From: =?UTF-8?Q?"Bill Caff=c3=a9" <bill@aid4mail.net>?=
To: =?UTF-8?Q?"St=c3=a9phane Fran=c3=a7ois" <steve@aid4mail.net>?=
cc: =?UTF-8?Q?"'Lisa Gruy=c3=a8re'" <lisa@gruyere.org>?=
cc: "John Fire" <john@aid4mail.net>
cc: "Tim Sand" <tim@aid4mail.net>
Priority: Low
X-Priority: 5
X-Mozilla-Status: 0001
Subject: Poem by Charles Baudelaire
MIME-Version: 1.0
Message-ID: <001901cbcf87$707c25b0$51747110$@aid4mail.net>
Date: Fri, 18 Feb 2011 17:18:13 0100
Content-Type: multipart/alternative;boundary="Next_Item:_(A3CB49KFSA19)/1"

Conversion by a competitor (hidden data)

Return-path: <bill@aid4mail.net>
Envelope-to: bill@aid4mail.net
Delivery-date: Fri, 18 Feb 2011 11:18:13 -0500
Received: from 131-39.62-81.cust.bluewin.ch ([81.62.39.131]:17353 helo=PrecisionT3500)
by centaur.dewahost.net with esmtpa (Exim 4.69)
(envelope-from <bill@aid4mail.net>)
id 1PqT25-00058l-7Z; Fri, 18 Feb 2011 11:18:13 -0500
From: =?utf-8?Q?Bill_Caff=C3=A9?= <bill@aid4mail.net>
To: =?utf-8?Q?St=C3=A9phane_Fran=C3=A7ois?= <steve@aid4mail.net>
Cc: =?utf-8?Q?'Lisa_Gruy=C3=A8re'?= <lisa@gruyere.org>,
"John Fire" <john@aid4mail.net>,
"Tim Sand" <tim@aid4mail.net>
Subject: Poem by Charles Baudelaire
Date: Fri, 18 Feb 2011 17:18:08 +0100
Organization: Fookes Software
Message-ID: <001901cbcf87$707c25b0$51747110$@aid4mail.net>
MIME-Version: 1.0
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Priority: 5 (Lowest)
X-MSMail-Priority: Low
X-Mailer: Microsoft Outlook 14.0
Importance: Low
Thread-Index: AcvPhydgtD/Fiez1TJSn19MfhrGhJw==
Content-Language: en-us
Status: RO
X-Folder: Inbox     

Conversion by Aid4Mail (hidden data)