2

I mounted an external disk, looked at its contents in the file browser, and then did "safely remove drive". Surprise: a small window pops up stating that it's writing to the disk and warning me not to unplug the drive until it's done. What the heck is there to be written? I did not create any files, or change any file names, etc.

Improve this question

1 Answer 1

Reset to default
3

Every time you look at files or directories - access-times are written to the filesystem.

It a pretty big deal if you are doing forensics. In those cases you surly want to mount as read-only.

Also if access to the fs was previously cut in the middle of an operation (unmounted improperly) then the next time you mount it - a recovery will make modification to the fs to bring it to a consistent state by consulting the journal.

Improve this answer
4
  • Extending this: If you want to change the access time writes, you can change your /etc/fstab to: noatime, relatime, etc. Check here for more info.
    – boehj
    May 5, 2011 at 17:02
  • Also at mount time the file-system is marked as mounted.
    – ctrl-alt-delor
    Jan 21, 2013 at 16:27
  • Also for removable media mounting it in sync mode, will be safer and quicker to dismount.
    – ctrl-alt-delor
    Jan 21, 2013 at 16:27
  • @richard: But slower to write to in some/many scenarios.
    – David Foerster
    Mar 9, 2015 at 18:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .