Forensic tools
I did some recent forensic work on a Terminal Server and I found NetAnalysis from Digital Detective a great tool to quickly analyze users' internet browsing activities. Not to mention it is relatively cheap (~$200) compared to the more popular commercial forensics tools. One of my ex-colleagues performs forensic work full-time and provided me his hit list of preferred tools (what he uses 90% of the time):
EnCase: what is cool is you can mount via EnCase and boot an image in VMWare
AccessData's FTK: good for email and quick searching, and has a protected storage viewer so you can reveal passwords stored by IE, Outlook, list Autocomplete strings and passwords, etc.
Snapview, UltraEdit, IrfanView, SMART
