I used a virtual machine (Windows host/Linux mint guest) to store some very sensitive and private data (it shouldn't be uncovered by state-level actors). Today I decided to check how much deleted files can be recovered from my host system using a popular disk drill software. After just few minutes of scanning I found out some recovered pictures from the guest machine! There were thumbnails (usually 256x124) of screenshots and telegram messenger pictures. All these compromising pictures had names starting with "GNOMEThumbnailFactory". There were also default wallpapers of my machine, that compromise plausible deniability I am trying to achieve.
How is this possible? Maybe these files leaked to swap file when Virtualbox used it, or Virtualbox loaded these files into some sort of cache? Also I used shared folder and guest additions (yes, I know that this is bad for security...), but I am sure that I didn't put all these images in shared folder and never sent them to host in any way. And is there any way to stop these leaks?
P.S. I also want to add that I had erased all free space on all disks with windows Eraser tool before I launched disk drill.
UPDATE: Thank everyone! I understood that I just forgot to remove the unencrypted copy of my virtual machine disk image. After removing it and leaving only the copy on the VeraCrypt encrypted partition my files recovering tool stopped to see VM's files.