I'm an avid fan of file system forensics but I'm an amateur so far. I've been reading up on NTFS forensics and I've noticed you sometimes can know if a file was on a certain volume even if it was deleted and the free space shredded with a tool. You can find it either in the USN journal (if it exists) or in the slack of an index block.
What I don't know is if any of the algorithms used for shredding are reversible. That is, if it just writes to free space random values or it just scrambles cluster by cluster whatever it finds there.
Also, is there a way to determine which algorithm was used to prove the shredding was deliberate? Is there a pattern?
Thank you, in advance, for your answers.