In recent years, the high incidence of network attacks has seriously endangered China’s information network security, and network attacks are developing towards automation and intelligence. The speed of vulnerability discovery and utilization is faster and faster, the firewall penetration is higher and higher, the security threat asymmetry is increased, and the damage to the network infrastructure is greater and greater, which poses a great threat to the security of cyberspace. When network attackers implement network attacks, they often use various technical means to hide themselves against tracking, which brings great challenges to the detection of network attack cases. This paper summarizes the characteristics of common network attacks, analyzes the characteristics of common network attacks and the electronic data generated, and analyzes different network attacks, and puts forward corresponding network forensics methods. It is of great significance and value for the investigation and evidence collection of network attack cases.