18

I want to find out the last time a filesystem was mounted on Linux (Debian). Any help?

Giacomo1968
  • 58,727
MichaelM
  • 914

4 Answers4

13

Update: well that was too easy

$ sudo tune2fs -l /dev/sda1
tune2fs 1.41.11 (14-Mar-2010)
Last mounted on:          /
Filesystem magic number:  0xEF53
Filesystem revision #:    1 (dynamic)
Filesystem state:         clean
Errors behavior:          Continue
Filesystem OS type:       Linux
Inode count:              7028736
Filesystem created:       Sat Nov 14 20:49:49 2009
Last mount time:          Wed Jun  9 18:19:42 2010
Last write time:          Thu Jun  3 09:38:18 2010
Mount count:              20
Maximum mount count:      32

and tune2fs handles ext4 partitions too, I just don't have one handy.

msw
  • 3,779
7

I've just found a way for NFS by reading /proc/self/mountstats (or any other PID). It gives the age in seconds:

device 1.2.3.4:/HOME mounted on /mnt/HOME with fstype nfs statvers=1.1
[...]
    age:    1047998
[...]
Benoît
  • 171
0

For future reference, msw's original "not too easy" answer from the edit history is below:

According to include/linux/ext3_fs.h the mount time is stored at offset 0x2c in the superblock of an ext3 partition:

...
/*
 * Structure of the super block
 */
struct ext3_super_block {
/*00*/  __le32  s_inodes_count;     /* Inodes count */
    __le32  s_blocks_count;     /* Blocks count */
    __le32  s_r_blocks_count;   /* Reserved blocks count */
    __le32  s_free_blocks_count;    /* Free blocks count */
/*10*/  __le32  s_free_inodes_count;    /* Free inodes count */
    __le32  s_first_data_block; /* First Data Block */
    __le32  s_log_block_size;   /* Block size */
    __le32  s_log_frag_size;    /* Fragment size */
/*20*/  __le32  s_blocks_per_group; /* # Blocks per group */
    __le32  s_frags_per_group;  /* # Fragments per group */
    __le32  s_inodes_per_group; /* # Inodes per group */
    __le32  s_mtime;        /*  Mount time  <--------------------------------------  */
/*30*/  __le32  s_wtime;        /* Write time */
...

(I've taken the liberty of making the Mount time a little easier to find.)

mwfearnley
  • 7,889
0

NTFS

For NTFS, the $Boot file should tell you when an NTFS partition was mounted last. You can use istat from the Sleuth Kit.

As discussed here, $Boot is at entry 7 of the Master File Table:

sudo istat /dev/sda1 7

Example output, which contains the modification date:

MFT Entry Header Values:
Entry: 7        Sequence: 7
$LogFile Sequence Number: 0
Allocated File
Links: 1

$STANDARD_INFORMATION Attribute Values:
Flags: Hidden, System
Owner ID: 0
Security ID: 0  ()
Created:    2023-06-05 12:39:04.827705400 (CEST)
File Modified:  2023-06-05 12:39:04.827705400 (CEST)
MFT Modified:   2023-06-05 12:39:04.827705400 (CEST)
Accessed:   2023-06-05 12:39:04.827705400 (CEST)


$FILE_NAME Attribute Values:
Flags: Hidden, System
Name: $Boot
Parent MFT Entry: 5     Sequence: 5
Allocated Size: 8192    Actual Size: 8192
Created:    2023-06-05 12:39:04.827705400 (CEST)
File Modified:  2023-06-05 12:39:04.827705400 (CEST)
MFT Modified:   2023-06-05 12:39:04.827705400 (CEST)
Accessed:   2023-06-05 12:39:04.827705400 (CEST)
Matthias Braun
  • 1,518