Is it possible to know when a file in a NTFS filesystem was deleted? For example, if you have the file in the recycle bin you have the metadata file that stores when the file was sent to the recycle bin. However, if the file was never in the recycle bin or the recycle bin was emptied, how can you know the timestamp of the deletion of a file?
Although it were not possible to know the exact date and time, is it possible to have a date interval?
EDIT: I know there exist multiple solutions that can be installed or configured to monitor deletion of files but I'm talking about the case you receive a HD and you have to do a forensic analysis of it. In that case you probabibly would have only what it is installed by default.