There‘s also the FSEvents database on the root of every disk which is a database of all the file events/operations that happened on that disk.

Supposedly you can disable it, but I haven’t got it to work. For example if you download a sensitive file, do something with it, and delete it. You can see this in the FSEvents database.

This is already a recall type feature at the file system level.