As "test disk" is able to restore overwritten/shredded (dev/urandom) or erased (dev/zero) partitions,
The documentation doesn't say it can do that. It just says it can find where they start (and/or end) when that information (which is usually in the MBR) has been lost. This is easy as most filesystems have signatures ("magic numbers") which can be identified, and/or they tend to be at certain places on the disk (for example, cylinder boundaries). Overwriting an entry in your partition table is much different than overwriting the partition itself. So far, as Simson Garfinkel has pointed out, nobody has shown any evidence that you can recover data after just one overwrite with zeroes. Then again absence of evidence is not evidence of absence. Lacking any evidence one way or the other, I assume it is possible in my risk analyses, since that way I don't get any nasty surprises. See: http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html http://www.simson.net/clips/2001/2001.TR.04.RememberanceOfThingsPast.pdf -- http://www.lightconsulting.com/~travis/ -><- "We already have enough fast, insecure systems." -- Schneier & Ferguson GPG fingerprint: 50A1 15C5 A9DE 23B9 ED98 C93E 38E9 204A 94C2 641B