The most critical challenge of web attack forensic investigations is the sheer amount of data and levelof complexity. Machine learning technology might be an efficient solution for web attack analysis and investigation.Consequently, machine learning applications have been applied in various areas of information security and digitalforensics, and have improved over time. Moreover, feature selection is a crucial step in machine learning; in fact,selecting an optimal feature subset could enhance the accuracy and performance of the predictive model. To date,there has not been an adequate approach to select optimal features for the evidence of web attack. In this study, ahybrid approach that selects the relevant web attack features by combining the filter and wrapper methods is proposed.This approach has been validated by experimental measurements on 3 web attack datasets. The results show that ourproposed approach can find the evidence with high recall, high accuracy, and low error rates. We believe that the resultspresented herein may help us to improve accuracy and recall of machine learning techniques; particularly, in the field ofweb attack investigation. The tools that use this approach may help digital forensic professionals and law enforcementin finding the evidence much more efficiently and faster.