I mentioned this in another post, but I think it is worth its own case. Writing "last accessed" time information to all files scanned might be part of the cause of this issue.
Reproduction steps: Run a full scan (iSwift/iChecker disabled for better reproducibility) of the system with Windows System Restore enabled.
Actual result: During the scan Windows keeps writing new data to System Volume Information and MFT, mostly in many small bits instead of single large ones. As a consequence drive utilization is increased during scan (sometimes affecting scan performance) and System Restore is filled up with likely unnecessary data.
After scan = over 1 gb extra data written to disk just by scanning via KES:
This also happens when KES trace file is disabled and also seems to happen while no temporary files are written to ProgramData by KES (scanning inside of archives).
Expected Result: No write operations to scanned folders. Other AV solutions also offer an option to have AV scans not change "last accessed" times on files, which makes a lot of sense.