Why write to an external disk I only looked at?

Question

I mounted an external disk, looked at its contents in the file browser, and then did "safely remove drive". Surprise: a small window pops up stating that it's writing to the disk and warning me not to unplug the drive until it's done. What the heck is there to be written? I did not create any files, or change any file names, etc.

score 3 · Accepted Answer · edited Jan 21 '13 at 16:43

3

Every time you look at files or directories - access-times are written to the filesystem.

It a pretty big deal if you are doing forensics. In those cases you surly want to mount as read-only.

Also if access to the fs was previously cut in the middle of an operation (unmounted improperly) then the next time you mount it - a recovery will make modification to the fs to bring it to a consistent state by consulting the journal.

edited Jan 21 '13 at 16:43

ctrl-alt-delor

661

answered May 05 '11 at 16:11

Aleksandr Levchuk

2,326

Extending this: If you want to change the access time writes, you can change your /etc/fstab to: noatime, relatime, etc. Check here for more info. – boehj May 05 '11 at 17:02
Also at mount time the file-system is marked as mounted. – ctrl-alt-delor Jan 21 '13 at 16:27
Also for removable media mounting it in sync mode, will be safer and quicker to dismount. – ctrl-alt-delor Jan 21 '13 at 16:27
@richard: But slower to write to in some/many scenarios. – David Foerster Mar 09 '15 at 18:04

Why write to an external disk I only looked at?

1 Answers1