User mode programs rely on syscalls to query certain data about the system, as all the data structures are stored in kernel mode. For example if you view a directory's contents, what happens in the background is that a syscall is made to enumerate directory conents. If you hook that function, you can filter the response any way you like.
For example, you can hide files by hooking the relevant APIs, you can hide registry keys, you can hide programs, you can hide network connections, as all these actions rely on querying the kernel for that information.
So if the forensics tool on a live system is relying on user mode APIs to get a process list for example, you will only see what the syscall hook will allow you to see.
