Clive McBarton <clivemcbar...@web.de> writes: >Stephen Powell wrote:
>> For example, the boot loader may be updating the mount >> count or updating the "last referenced date/time", if there is such >> a field in the filesystem, for the kernel image or the initial RAM >> disk image. >I assume you mean "atime", which exists in ext3. And no, it was not >updated. I checked with ls, it has the same value it had since the last >kernel update. An ext3 filesystem has a last mount time in the superblock. This is different to any of the POSIX times in the root directory of the filesystem. The Linux kernel does not update this field on a read-only mount. If it were me trying to diagnose this, I would be diffing the images that should be the same and seeing where they are different. There's plenty of info out there on the data structures of the ext3 filesystem, so it shouldn't be too difficult to determine which attributes or other parts of the filesystem are being modified. At that point, then you can start speculating on what application is making the modification. Trying to guess what is making the modifications without knowing what was modified is going about it backwards. -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/6585.4b96fc84.21...@getafix.xdna.net
