Thoroughly examine all data on a computer system, locate any evidence that is stored on that system and safely preserve that evidence for use in a court of law.

Quickly investigate and positively determine if any compromises have been made to your systems as a result of an incident, without taking your systems out of service.

Check for policy violations or conduct internal investigations remotely through your company's network.

Take baseline images of your systems and when required, compare with current images to understand changes made, such as files created  or destroyed since the last image was taken.