Network captures, or packet captures, are essential to digital forensics. First, they play a critical role as a primary source of evidence as they provide a detailed record of all network communication. These network captures provide details about what systems were communicating, when (timestamps), IP address information (source and destination), and even what protocols were being used! Obtaining a network capture also allows one to reconstruct the events that took place. Depending on the amount of network traffic captured, you can understand what occurred before and even after the incident.