Samira wrote:
You should be able to get a time of deletion, but it really depends on how much activity has overwritten that data in the mean time.
I'm not as up on the low level specifics of NTFS, but I don't think that's the case. Files generally contain creation times, modification times, and access times. That data is typically deleted when the reference to the file in the parent directory is erased. I suppose that may be recovered if there hasn't been sufficient file activity in that directory to force a rehash of the directory table, but this still wont tell you when the file itself was deleted. You may be able to extrapolate a time range in which the file was probably deleted, but that's about it. This may be sufficient, or it may not...
As to cleaning the hard drive. It's quite possible to zero out a hard drive and make it impossible to recover anything from it. It's done all the time when there's potentially sensitive data on a disk and you're doing something like selling back a piece of hardware with the attached system (happens all the time). I usually prefer to just buy another blank disk and put it in there, but occasionally we do zero out disks. You don't use format or fdisk. You actually write zeros to each data block of the disk, typically using something like the 'dd' utility in unix.
Of course, this only really works if you want to erase the entire contents of a disk. The typical home user isn't going to do this ever, much less "often".