Our method usually replicates the step-by-step actions of an attacker. We conduct an in-depth forensic investigation of suspected malicious network security incidents, and we carry out an investigative analysis of computers, mobile devices, networks, memory drives, databases, logs, files, etc. This is important to gather information and evidence and detect intrusion. As a consequence, we can discover and analyse patterns of fraudulent activities resulting from criminal activities.