How is netgear intercepting requests from another device?

This is a double-black-diamond question.

I had looked into Netgear readyshare and found it not suitable. What I did find was a similar functionality, better supported, on my obihai.

The obihai storage worked really well. Could write programs to access it. Every machine on the network worked with it. Pretty fast. So far so good. All accesses are over a static address to it. Worked on it for several days without a single bad incident.

Then I left some uploads running overnight.
In the morning -- nothing was showing on the obihai except for 3 items:
[efi, netgear_downloader, bootlog.bak(? or similar)].
Where did they come from?

How did netgear items end up as a result to a call to obihai's flash storage?

I removed and checked the obihai flash.
No problem, all my wanted files were there. 

I put in a new flash to obihai. That worked too. Everything as it should be.

I put back the problem disk. Again, all I see are netgear files. 

I did a deep format of the disk, recopied the files.

Again, all I see are netgear files. 

How exactly is this happening? The netgear files are definitely not on the re-formatted flash drive. For good measure, I even reset the System Volume Information too. 

The likely explanation is that something is getting intercepted and redirected.

Is netgear doing that? Is the obihai doing it? 

But where is that happening and how to track it down and disable it? I turned off all readyshare features in the router, but I doubt that is significant. The problem drive have previously been used in readyshare, but I would think the reformatting would have taken care of any possible history there.

Other than the apparently redirected requests to the obi flash drive, the rest of the obihai looks as it should. Furthermore, with a different disk, that also works. This is getting weird.

So the question is: How and why would those netgear files show up after a request is made to a device that does not have them? There has to be answer somewhere. Any background information about those files as to where they originate, how they are used, etc. might be helpful here. 

In a moment of not clear thinking, I deleted those problem files. That worked. But where exactly did it delete them from?

Both readyshare and obihai are mini-webservers serving up files from local storage. About the only conclusion I can draw at the moment is that some routing is going haywire -- but at what point and how to track it down?

Richard.