Forensic note: when a Unix file is removed with shred, the indirect blocks DO NOT get overwritten. Could be an interesting indicator.