I have a drive that I'm working to replace. I believe it's no longer in use by any system or user and that it can be removed. I've copied everything off of it that I think is relevant.

Is there a way to prove that the drive isn't in use any more?


  • Examine a hash of the entire drive's contents now and compare it in a week?
  • Log any access to the drive using lsof or some other kernel-level feature?
  • Get the last read or write information from the SMART utils on the drive?

Any other ideas? Ideally I'd like to monitor it for a week or so, just to be sure. If any data is read or written during that time, I'd like to know that fact.

Seems like a simple concept, but I haven't been able to find any good results for this.

UPDATE - The filesystem is ext4.

  • 7
    Un-mount the filesystem, and wait for shouting? The advantage being that you can have it offline, but be easy to re-enable? – Zoredache Jun 21 '17 at 22:45
  • 3
    Does lsof work for you in this case for monitoring? – Anthony Kong Jun 21 '17 at 22:45
  • @Zoredache I think that must be the standard practice, but....this feels like something a computer can do better. – mlissner Jun 21 '17 at 22:58
  • 3
    Well the more useful answer would probably depend on what exactly this drive was being used for in the first place. What services were storing data on it, and so on. Monitor those services. Without more specific details about how it was being used, what filesystem was on it, or so on, I am not sure anyone will be able to suggest anything that can be applied universally. – Zoredache Jun 21 '17 at 23:01
  • Have you tried udiskctl power-off -b /dev/sdn? (where sdn would be the appropriate device file, of course). Its man page states: Arranges for the drive to be safely removed and powered off. On the OS side this includes ensuring that no process is using the drive, then requesting that in-flight buffers and caches are committed to stable storage. The exact steps for powering off the drive depends on the drive itself and the interconnect used. – Pablo Jun 21 '17 at 23:39

cat /proc/diskstats. Take note of the values for the device you wish to remove. Wait a period of time. cat /proc/diskstats again. If the first or fifth numbers after the device name have gone up, something has read (first number) or written (fifth number) from/to the disk over the time period at hand.

Documentation/iostats.txt has all the gory details about /proc/diskstats and what all the numbers mean, if you're into that kind of thing.

  • This is wonderful! Thanks for hopping in here to show that I wasn't crazy! – mlissner Jun 28 '17 at 17:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.