The Gap That General-Purpose Platforms Leave Open
Email evidence sits at the center of the majority of digital investigations—fraud, insider threat, IP theft, regulatory response—yet the platforms most forensic teams rely on were not built for email as a primary workflow. They collect what is in the mailbox. They may not recover what was deleted, retrieve what was never downloaded, or capture the cloud documents that modern emails reference rather than attach. For investigators who need the complete picture, that gap has consequences.
Key Capabilities
► Cloud attachment collection. When emails contain links to OneDrive, SharePoint, or Google Drive rather than traditional attachments, standard collection tools capture only the URL. Aid4Mail retrieves the actual file, including the specific revision that existed when the email was sent, along with full access and collaboration metadata. Aid4Mail is currently the only forensics tool to provide this capability across both the Microsoft and Google ecosystems.
► AI classification—cloud and offline. Aid4Mail integrates AI classification directly into the processing pipeline, enabling practitioners to classify large email collections by responsiveness, privilege, or investigation-specific categories without manual review of every message. The framework has been benchmarked across 18 models, including accuracy-verified testing on 1,170 emails across three languages and a 34,000-email production-scale throughput validation. It supports commercial providers (Anthropic, Google, OpenAI, and others) alongside locally deployed offline models via Ollama or LM Studio. The offline option meets the data sovereignty and air-gap requirements of law enforcement, government agencies, and privacy-constrained enterprises. Every classification is structured, per email, and auditable. In accuracy testing, top-performing commercial models achieved weighted scores above 97%. For throughput-focused deployments, the fastest models processed over 400,000 emails in a single weekend (62 hours).
► Microsoft 365 App-Only Access. Enterprise investigations involving multiple custodians typically require individual credentials or IT-managed collection for each mailbox. Aid4Mail’s App-Only Access allows an administrator to grant tenant-wide access through a single IT-administered configuration, enabling organization-wide collection without requiring individual user credentials or per-mailbox enrollment.
► Advanced email recovery. Deleted does not mean gone. Aid4Mail recovers double-deleted emails from IMAP and Exchange Recoverable Items, extracts MIME-formatted messages from unallocated disk space and corrupted archives through forensic carving, and repairs damaged mbox files that other tools cannot process. In internal testing on standard corruption scenarios, Aid4Mail achieved a 100% recovery rate against a competitor average of 65%.
“Forensic Focus reaches practitioners who work with email evidence every day. We’re here to show specifically what Aid4Mail does that general-purpose platforms don’t—not as a replacement for the tools investigators already use, but as a specialized solution that adds capabilities general-purpose platforms often lack.”—Eric Fookes, Founder & CEO, Fookes Software Ltd
