Attack Analysis is a necessity after breaches of the system; without an accurate attack analysis, network forensics works poorly.It is a fact that defining the attacker and apprehending the perpetrator are more costly and complicated during the investigation phase.Analyzing attack evidence and linking this with previous attack incident responses.makes the investigation outcome more accurate and improves the quality of decision-making.This paper proposes a network forensics attack-analysis model that identifies the attack intentions of a new attack and estimates the similarity of this new attack intention to previous ones.A similarity metric for attack intention will be generated to determine similar attack intentions.Lastly, the similarity of the attack intention will be used to determine the similarity between the incident respouse required for the new attack and that required for previous attacks, using a pre-defined incidence response database.Experiments were performed on packet capture, where network data traffic generates a backdoor attack, to evaluate the proposed model.Results show that the proposed model can reduce effort and processing costs during the investigation process.