In the performance of any network forensic examination, the following is always the main process:        Identification: Identifying what and the extent of data to be collected for investigation.       Preservation: Ensuring that the integrity of the collected evidence has been retained and ensuring that the chain of custody had been properly maintained.       Collection: Gathering network traffic data relevant to the case, logs, and other pieces of evidence.       Examination: Analyzing the collected data to locate any signs of intrusion, malware, or unauthorized activity.       Analysis: Drawing conclusions from the investigation and re-creating a timeline of events to determine the cause.       Reporting: Writing up findings and preparing materials to be used in court, if necessary.