Preservation, identification, extrication and documentation of computer evidence; giving ability to gather files, lltbkfdt collect backups of data, gives tools to look at what was going on with data.

• 保存、鉴别、抽取和归档计算机证据；提供能力来搜集文件和数据备份，提供工具来观察过去的时间里发生的与数据有关的事件。