I was thinking perhaps the hash is from something like BitTorrent, where they have a list of hashes that actually identifies components of the file. Then they see that the data for a particular series of matching hashes looks like they were saved to an external drive.