Is there a way in the linux to find files which were accessed (read, write, doesn't matter) during computer boot and work? Or even better files that were NOT accessed at all during some time? I know there is a find / -atime +60 (for example for older than 60 days files) command, but problem is that in this system the modification of atime attribute for files is disabled as it works from flashcard. So i need some other way to find those files.

  • 4
    Consider accepting correct answers to your questions. Also, upvote useful answers. Dec 15, 2010 at 17:03
  • Sure i will. I can't upvote answers yet, system doesn't allow it for me.
    – lugger1
    Dec 15, 2010 at 19:19

1 Answer 1


For files accessed during boot, I'd start with ureadahead:

$ sudo ureadahead --dump | grep /

which dumps the content of /var/lib/ureadahead/pack where the profiled boot file accesses are stored.

Otherwise there are lots of ways to monitor file access:

bootchart might be helpful to visualize what's happening during boot.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .