./ftkimager hash mismatching

Under what circumstances have you ever seen Windows directly modify the data of a file on an external drive just by plugging it in?

Anti-virus could have quarantined/deleted a specific file on the drive that it didn't like the look of. We hope that software write-blocking works, but It's not seen to be as trustworthy as hardware write-blocking.

Are we definitely dealing with hashing individual files, and not a volume/physical disc here? Also, you mentioned that you have done work initially in Linux, then Windows. Is everything definitely using the same SHA, as opposed to one tool providing SHA1, and the other SHA256?

Hope this helps