Nowadays, cyber crimes are increasing and have affected large organizations with highly sensitive information. Consequently, the affected organizations spent more resources analyzing the cyber crimes rather than detecting and preventing these crimes. Network forensics plays an important role in investigating cyber crimes; it helps organizations resolve cyber crimes as soon as possible without incurring a significant loss. This paper proposes a new approach to analyze cyber crime evidence. The proposed approach aims to use cyber crime evidence to reconstruct useful attack evidence. Moreover, it helps investigators to resolve cyber crime efficiently. The results of the comparison of the proposed approach prove that it is more efficient in terms of time and cost compared with the generic and the modern process approach for network forensics.