SenorBeef has the main gist of it, although there are a few minor points I’ll clarify.
The regular invisibility watch makes you 100% invisible for a limited time (10 seconds, I think, but don’t quote me on that). However, if you bump into the spy (and you’re on the other team) he will faintly show up as a shadowy figure, alerting you to his presence. In addition, the watch recharges its timer whenever you’re uncloaked AND whenever you pick up ammunition (whether or not you are currently cloaked). This includes dropped weapons from fallen players. Using this method, it’s possible to extend your invisibility time past the normal 10 seconds or so. Even while invisible, you take damage as normal, and your position can be revealed by fire, jaratee, mad milk, or climbing out of water (it produces a dripping effect for a few seconds.
There’s a second invisibility watch called the Cloak and Dagger, which only depletes its timer while you’re moving. If you’re uncloaked or cloaked and standing still, the timer recharges. This means that, technically, you can be permanently invisible. However, this watch doesn’t recharge from ammunition. Also, if you run out of charge, you don’t decloak like with the normal watch. Instead, you become partially visible as though you had been bumped until you decloak or stand still to recharge the watch. Other than these differences, the Cloak and Dagger acts much like the normal watch.
The third watch (and my personal favorite) is the Dead Ringer. This watch has the downside that you can’t cloak when you activate it. Instead, it instantly cloaks you whenever you take damage with the watch active. I’m pretty sure that the cloak time is shorter than the regular watch, as well. However, it has the additional effect that it reduces all damage you take while cloaked, including the initial hit, by something like 90%. Moreover, the cloaking effect is perfect; you don’t become partially visible when bumped into. However, there are ways to identify the position of a Dead Ringing spy while cloaked: pyro flames, jaratee, mad milk and water drips all show up. While any afterburn effects are cleared if they occur PRIOR to activation, you can set someone on fire after they cloak as normal. Also the other effects (jaratee, etc.) DO NOT wear off just because someone activates the cloak. This makes jaratee snipers particularly dangerous. In addition, you can’t attack while the watch is “primed”, so to speak, nor can you reload. Thus, if you see a known DR spy attack just prior to dying, you can be reasonably certain you’ve killed him for real. When uncloaking with the DR, you also make a loud buzzing noise; it’s much louder than the other watches noises. You can use this sound as a cue that someone is Dead Ringing nearby. As one final note, unlike the other watches, you can only activate the DR when at a full charge, so if you get hit, you can’t recloak for a while; ammo also has a lessened effect on recharging the DR timer.
Regarding the disguise kit, in addition to SenorBeef’s comments, there’s one other good way to spycheck someone: you can walk through teammates, but not enemies. If you bump into a “friendly” player and stop in your tracks, it’s a spy. Also, spies can disguise themselves as members of their own team. (The ‘-’ key, by default, changes which team you disguise as.) That’s how I usually get behind the enemy: disguise as a friendly with my Dead Ringer out, get as close as I can to the enemy before getting hit, then get behind their lines and disguise as an enemy while cloaked. If I do it right, they won’t realize there’s a spy about because they’ll never see one of their own team strolling unimpeded through the opposing force. Then: backstab time.
