Just mounting with write access (rw) could be writing things, on ext filesystems there's at least the following attributes that are updated:
- Last mounted on
- Mount count
- Last mount time
- And possible files access times that are updated when if files are just read (mount's
noatime should stop those).
- And a "Last write time" attribute if writing occurs)
Actually, mounting without write access (using mount's
-o ro) might still write to the device, see man mount:
Mount the filesystem read-only. A synonym is -o ro.
Note that, depending on the filesystem type, state and kernel behavior, the system may still write to the device. For example, ext3 and ext4 will replay the journal
if the filesystem is dirty. To prevent this kind of write access, you may want to
mount an ext3 or ext4 filesystem with the ro,noload mount options or set the block
device itself to read-only mode, see the
blockdev has the
--setro command, to set a block device as read-only
You could compare the images and see which bytes are different, with
cmp or something like
vbindiff. Only a few bytes could be a date or count somewhere (I'm not sure if the attributes are stored as plain text, or encoded somehow).
Or read-only mount two (or more) of the images and compare just the files. Plain
diff can compare directory trees, but I prefer a gui like
kdiff3. If the only difference is in the mount count or last mount time it won't show up in the files (different file access times probably won't either).
Or maybe the device or your ram or something else is going bad & reading different bytes here & there.
You could also keep the device unmounted, make an image, then unplug & reconnect the device (still unmounted) and make another image & then compare, they should be the same.