I want to find out who deleted a specific file from a USB disk.
The disk is formatted as NTFS. The file was deleted while the disk was plugged into a Windows 7 system. However, while I do have possession of the USB disk, I do not have access to that system anymore.
Using forensic techniques, with the presumption that no data was written over the deleted file, is it possible for me to determine who deleted it? Does this change, if there was newer data written over the file or if the culprit attempted to cover his tracks in any way?