Network forensic plays an important role in the modern network environment for computer security, but it has become a time-consuming and daunting task due to the sheer amount of data involved. This paper proposes a new method for constructing incremental fuzzy decision trees based on network service type to reduce the human intervention and time-cost, and to improve the comprehensibility of the results. At the end of paper, we discuss the performance of the forensic system and present the result of experiments.