This product is the big brother of its family, including all the forensic capabilities of other versions with the additional ability to conduct investigations over the network and compare live systems to known-good baselines to establish whether a machine has been compromised or tampered with.
Every attack on a computer system leaves a trace behind, no matter what an attacker might to to cover their steps. Also, data can be hidden by an attacker to use later as a back door. Forensics in part looks at uncovering evidence of this activity.