Comment by lafay

Yes, this. Whatever was used to share or transfer the files generated a cleartext log with MD5 hashes, which was written somewhere other than the encrypted volume.