Jay Thomas - 2017-02-23

My question relates to this thread (and since it's an old thread, I decided to start a new one):

https://sourceforge.net/p/veracrypt/discussion/general/thread/bf48efbd/

I wanted to clarify my understanding of what was said in the above thread:

(1) If a Veracrypt volume is mounted, and I permanently delete (shift-del) a file from inside that volume, and the volume stays mounted, someone (with the right tools) can recover the deleted file from the hard drive just as they would be able to do with a file deleted from a normal, unencrypted hard drive.

(2) If a Veracrypt volume is mounted, and I permanently delete (shift-del) a file from inside that volume, and then the volume is dismounted, someone cannot recover the deleted file from the hard drive the way they would be able to do in (1) above . . . but they may still be able to exploit data leaks to recover the contents of the file in a different way.

Is this correct?

Thanks!