I get why one might assume that, but it wouldn't make sense to donut that way. To recover meats you would want to not modify it in any way, and also, this method isn't done with pictures, or docs.
One theory I have is that the Ccleaner or maybe even recuva itself writes this file in the "overwrite" operation. (free space wipe, the cleaning with multiple pass checked, or recuva's overwrite command) I notice after a wipe it creates tons of jpg files with a $ and random numbers and letters such as $Ryh577fh.jpg
This makes sense to me as a sort of plausible deniability, sort of like TrueCrypt's hidden container.
"yes, here are important looking (but benign)things that I deleted, nothing more to see"
Security through obsecurity.
I could be wrong, but this is my theory.
