My question is, if an attacker where to inspect this hard drive, would they see that wallet2.dat was ever there?
This is a matter of forensics, but this has also to do with the software. For instance, some software leave temporary files in certain "temp folders", or have a "recently opened" files on a dropdown menu, etc.
Your debug.log file may contain the files names and full path of the recently loaded wallet files
but since you've "
shredded" it, there may not be any recoverable data from the drive depending on its effectiveness.
But in order to fully remove the trace, shred the logs as well.
The "
Open Wallet" drop-down menu in Bitcoin Core is based from the available wallets in the data directory, so previously used but deleted wallets wont appear there.
The cached data in your RAM wont be an issue after a few minutes.
Other than those, I don't know if there's any other traces of it. (
wait for other users' inputs)