This document discusses tools that can be used in a deposition for a computer expert. It outlines some of the most commonly used forensic tools like EnCase and OSForensics that allow investigators to recover deleted files and search drives. Both programs create images of storage devices to prevent corrupting original evidence. EnCase has more robust search features while OSForensics provides timelines and fast searches. Investigators also have tools to examine mobile devices and retrieve digital evidence from phones. Computer experts can be hired to use these tools and analyze drives for legal cases.