<br><br><div class="gmail_quote">On 15 December 2010 17:46, mike cloaked <span dir="ltr"><<a href="mailto:mike.cloaked@gmail.com">mike.cloaked@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<br>
I could not find any direct way to get at the last umount time but I<br>
wonder if this is recorded in the /var/log/messages file ?<br>
<br></blockquote><div><br>For ext4 (and presumable ext2 and ext3 as well) the unmount time is not recorded explicitly. However, if a file system was last mounted read-write and it currently unmounted then the "Last write time" shown by dumpe2fs will show the unmount time. (This is because the file system is updated to mark the file system clean and, of course, this updates the last write time.) Nothing is updated if the file system is mounted read-only, including the last mount time.<br>
<br>Note that information about when a file system was last mounted or unmounted stored outside the file system is essentially worthless. When I was checking what happened to the last mount time and last write time I was using an external disk. If the last mount and unmount times were recorded locally then there would be no way of knowing whether the file system had been mounted elsewhere. Internal disks can be mounted using live dvds.<br>
<br>I haven't looked to see what information is available for other file systems.<br><br>jch<br></div></div>