Acting on information from students who reported seeing a classmate looking at inappropriate material on a school computer, school officials used forensics software to plunge the depths of the PC's hard drive, searching for evidence of improper activity. Images were found in a deleted Internet Explorer cache as well as deleted file space. Additional evidence collected from log files was joined with the software-gathered evidence to identify the student who was logged on at the time the images appeared on the computer. Once the investigation concluded, the offending student was suspended for three days. Later, in a suit brought by the student's parents, the district successfully defended its position by showing the use of proven evidence-collecting methods and procedures--and by providing a written appropriate use policy that the student was shown to have violated. Today, forensic software tools can root out the truth of any misappropriated computers. Two computer investigative software programs are described, and tips for using these types of programs are suggested.