Network forensics is a subset of digital forensics that entails monitoring and analyzing computer network traffic for the purposes of obtaining information, legal evidence, cyber crime investigation, and managed threat detection.
When there are network breaches, data theft, or anomalous network behaviour, Network Forensic Investigation is performed. Its primary goal is to identify and analyze network traffic that has been tampered with by hackers, such as a DDOS attack. In network forensics, event logs are commonly utilized to show timing. Investigators utilize this information to do adequate analysis. It's utilized as a part of a wider digital forensic inquiry to assist in putting together missing pieces and offer an overall picture to the investigator. By revealing the initial compromising technique and approach, it can aid in the root-cause investigation.