Network forensics is one of the digital forensic fields and is responsible for capturing and detecting the potential threats in the computerized network environment. Network forensic processes can identify digital crimes, collect all the normal and abnormal network traffic, examine the networks, and generate a forensic hypothesis for the evidence admissibility in a court of law. In particular, evidence identification and acquisition become a vital forensic process in the dynamic and distributed network environment.
   In computer networks, incident detection and analysis involves the examination of internal incidents, stolen information or assets, threat evaluation, and attack goals from the measure of the network performance. Identifying the necessary evidence and traces from the computer networks greatly helps to apprehend the cybercriminals with the legal procedures. Network forensic tools or techniques assist the cyber forensic investigator monitor and identifying the malicious information in the network traffic.
   With the ever-increasing adoption of online services, security systems need to be developed with new investigation processes for handling the emerging network incidents and cybercrimes and maximizing the evidence admissibility in the court. Nowadays, attackers greatly affect financial transactions during communication over the network. Hence, the evidence identification and acquisition process needs to focus on recovering lost data during the network communication, abuses of network insiders, and detection of network packets that are influenced or affected by the cyber criminals within the network.