Cloud computing is Internet-based computing, whereby shared resources, software, and information to computers and other devices on demand. Besides the benefits, it provides a new environment and convenience for network crime, which results difficulties and challenges for forensic investigation. This paper reviews the conception of cloud computing and identifies some key issues of network crime. After analyzing the mechanism and architecture of cloud computing, we propose a forensic model to obtain and fix the criminal evidences. Through investigating from cloud and client aspects, we collect relative log files and communicated data packages, which can succeed to monitor network and store original crime behaviors.