I have a drive that I'm working to replace. I believe it's no longer in use by any system or user and that it can be removed. I've copied everything off of it that I think is relevant.
Is there a way to prove that the drive isn't in use any more?
- Examine a hash of the entire drive's contents now and compare it in a week?
- Log any access to the drive using lsof or some other kernel-level feature?
- Get the last read or write information from the SMART utils on the drive?
Any other ideas? Ideally I'd like to monitor it for a week or so, just to be sure. If any data is read or written during that time, I'd like to know that fact.
Seems like a simple concept, but I haven't been able to find any good results for this.
UPDATE - The filesystem is ext4.