If we.play this.out, let's apply Occam's razor.

If they deleted files AND overwrote the exact sectors with replacements, does it make sense that they would:

• also leave the file allocation tables showing the deleted status?
• ensure the new replacement data files match in size and blocks to match the FAT?

Further, if they thought about doing the above, wouldn't that be more difficult and require the same skillset to:

• wipe the FAT entries so they don't show up?
• overwrite the sectors with a few passes of random data

The latter is far easier than the former. we're not talking about entire drives, either, so random passes wouldnt take much time. Data files weren't that big. Also, sql data files usually preallocate in contiguous blocks to keep read and write speeds higher. This makes overwriting random data easier.

I don't buy that they were advanced enough, or calculated enough to put fake files in place and keep them marked as deleted as a red herring. They are just bad at IT.