The vast majority of cloud computing environments do not provide built-in support for cloud forensics. Current incident response solutions for cloud environments primarily focus on detection and mitigation, and lack structured approaches for supporting forensic investigations. This chapter attempts to bridge the gap by proposing a comprehensive workflow for investigating cloud incidents. Best practices implemented by leading cloud service providers are incorporated in the workflow. The integration of a cloud anti-forensics module in the workflow is a novel feature that distinguishes it from other approaches.