I'm in the (long, drawn-out) process of re-starting (and updating) my backup procedure. This time around, I'm adding a pair of external eSATA hard drives that will cycle to an off-site location. Reasoning that while these drives are off-site and unattended they're more vulnerable, I'm encrypting them using TrueCrypt.
However, I've noticed something odd. The filesystem on my TrueCrypt volume is ext4, which of course has the top-level
lost+found directory. But I've noticed that after it has been mounted for a while (we're talking days here, I've been too busy to stay focused on this task for any real stretch at a time) the
lost+found directory disappears. I can still apparently write to it (
touch foo created a file, no errors, although I deleted it before thinking to try unmounting/remounting it to see if it stuck around), and so far SMART hasn't found anything wrong with the physical drive (it's currently unmounted and running an offline test via
smartctl -t offline /dev/sdf, which has another 5-ish hours to go).
My question is, does TrueCrypt automatically unmount an encrypted volume after it's been idle for a certain amount of time? If so, can I override that behavior? If not, what else can explain what I'm seeing? What would I look for in the logs (which are flooded with spam from cron and dhclient, the latter I really need to kill because the server has a static IP, so I haven't been able to spot anything even remotely relevant)?
FWIW, I mounted it with
truecrypt /dev/sdf1 /mnt/esata, and I've unmounted it with
truecrypt -d (it's the only TrueCrypt volume). I'm using the latest TrueCrypt 7.0a 64-bit console-only, downloaded straight from their website. This is running on an Ubuntu 10.10 server. The process to create the TrueCrypt volume was (roughly) 1) Create an empty partition, 2)
truecrypt -c /dev/sdf1 and then follow the on-screen prompts (reasonable password, no keyfile, no hidden volume, format with ext4). Sorry I can't be more exact on this bit, but it was about 2 weeks ago and I have the memory of a goldfish.