Originally posted by 35mmfilmfan Thanks for that clarification @kypfer.
The only software that touches the images on the actual card in my PC is Windows File Explorer, which I use to copy the files to their destination. Once done, I eject the card prior to using any processing software - just in case !
Windows Explorer may be all it takes, if the "background settings" are configured appropriately.
As with music files and other media, if Windows is given the opportunity it can try to add any appropriate file it can find to various indexes for "search" purposes (and possible data harvesting, GPS locations or whatever) and part of this procedure can be to modify the EXIF so's it knows not to bother a second time.
I strongly suspect, but never finally bothered to prove, that Google's "Picasa" and probably some of Adobe's offerings perform a similar function, sitting permanently loaded quietly in the background as a 'plug-in', 'add-on' or 'background service', automatically activating whenever an appropriate file became available!
I do know I had many months worth of image files "infected" like this when I was doing some software comparison tests many years ago, some were recoverable from archive, others were permanently damaged unless the EXIF data was manually edited on a file-by-file basis!