With the development and progress of science and technology, human are coming into information society, the data safety problem which is brought by rapid development of computer technology has become an outstanding problem. A system structure model of network invasion forensics is designed in this text. The model analyze the invasion detecting, at the mean time, collect all network data of target system to support network forensics, realizing on-line invasion detecting, off-line forensics analysis. This text elaborates the system architecture of model and discusses the model characteristics and existing problem.