[UFO Chicago] does Ubuntu cache/index the contents of mounted drives ?

[Calvin Pryor]

On Mon, Mar 9, 2015 at 9:27 PM, Calvin Pryor <calvinpryor at gmail.com> wrote:

> On Mon, Mar 9, 2015 at 5:42 PM, <jay at m5.chicago.il.us> wrote:
>
>>
>> Centuries ago, Nostradamus predicted that Calvin Pryor would write on Mon
>> Mar  9 20:20:16 2015:
>>
>> >
>> > I'm wondering if a listing of the files on this 1T drive might be cached
>> > somewhere on the hard drives for the two different Ubuntu installs it
>> was
>> > mounted to ?
>> >
>>
>> The updatedb program is normally run once every 24 hours.  Whether the
>> updatedb program retained knowledge of those files depends on where
>> they were mounted, and on the contents of /etc/updatedb.conf, and on
>> whether updatedb has been run again since those files were taken off
>> the system.  It probably has, so it's probably too late for you, but
>> the first thing you should do is modify the appropriate cron file to
>> prevent updatedb from running again, while you figure out whether you
>> can locate any trace of them in the updatedb database.
>>
>>
>>                         Jay F. Shachter
>>                         6424 N Whipple St
>>                         Chicago IL  60645-4111
>>                                 (1-773)7613784   landline
>>                                 (1-410)9964737   GoogleVoice
>>                                 jay at m5.chicago.il.us
>>                                 http://m5.chicago.il.us
>>
>>                         "Quidquid latine dictum sit, altum videtur"
>>
>>
> Jay thanks for the response.
> I maybe in luck.
> Due to a faulty SATA controller on the motherboard, both Ubuntu installs
> crashed (one ended up at a Busybox prompt, the other at GRUB).
> So it's possible that updatedb didn't run as scheduled and still has some
> info.
> I'll image the two hard drives, mount the images as read only, and take a
> look at updatedb.conf.
> I'll look into this "modify the appropriate cron file to prevent updatedb
> from running again"as well.
>
> Thanks again.
>

Took a while to fix the corrupted ext4 partitions for the two hard drives
but I finally got them mounted on my Windows machine with Ext2fsd

The logs on both drives at /var/log/fsck/checkfs say "Nothing has been
indexed yet" so no luck there.


** Note fstab/mtab/updatedb.conf are identical for both drives **


Here's the contents of upddatedb.conf

PRUNE_BIND_MOUNTS="yes"
# PRUNENAMES=".git .bzr .hg .svn"
PRUNEPATHS="/tmp /var/spool /media /home/.ecryptfs"
PRUNEFS="NFS nfs nfs4 rpc_pipefs afs binfmt_misc proc smbfs autofs iso9660
ncpfs coda devpts ftpfs devfs mfs shfs sysfs cifs lustre tmpfs usbfs udf
fuse.glusterfs fuse.sshfs curlftpfs ecryptfs fusesmb devtmpfs"

which looks like the paths "/tmp /var/spool /media /home/.ecryptfs" would
have been excluded from being indexed ?

Wouldn't that 1T drive be mounted at /media ?


looking at fstab

# /etc/fstab: static file system information.
#
# Use 'blkid' to print the universally unique identifier for a
# device; this may be used with UUID= as a more robust way to name devices
# that works even if disks are added and removed. See fstab(5).
#
# <file system> <mount point>   <type>  <options>       <dump>  <pass>
# / was on /dev/sda1 during installation
UUID=607e40b8-742a-4343-8bbb-8ce2d4900431 /               ext4
 errors=remount-ro 0       1
# swap was on /dev/sda5 during installation
UUID=f7f8b423-ebf8-4f02-86c2-a8773568910a none            swap    sw
       0       0

I only see the OS drive (/dev/sda1 mounted at root ?) and a swap partition.
Would it be fair to say then that I did not have the 1T drive set up to
auto mount ?

Also don't see any sign of the 1T drive in mtab

/dev/sda1 / ext4 rw,errors=remount-ro 0 0
proc /proc proc rw,noexec,nosuid,nodev 0 0
sysfs /sys sysfs rw,noexec,nosuid,nodev 0 0
none /sys/fs/cgroup tmpfs rw 0 0
none /sys/fs/fuse/connections fusectl rw 0 0
none /sys/kernel/debug debugfs rw 0 0
none /sys/kernel/security securityfs rw 0 0
udev /dev devtmpfs rw,mode=0755 0 0
devpts /dev/pts devpts rw,noexec,nosuid,gid=5,mode=0620 0 0
tmpfs /run tmpfs rw,noexec,nosuid,size=10%,mode=0755 0 0
none /run/lock tmpfs rw,noexec,nosuid,nodev,size=5242880 0 0
none /run/shm tmpfs rw,nosuid,nodev 0 0
none /run/user tmpfs rw,noexec,nosuid,nodev,size=104857600,mode=0755 0 0
none /sys/fs/pstore pstore rw 0 0
systemd /sys/fs/cgroup/systemd cgroup rw,noexec,nosuid,nodev,none,name=
systemd 0 0
gvfsd-fuse /run/user/1000/gvfs fuse.gvfsd-fuse rw,nosuid,nodev,user=
calvinpryor 0 0


on another track.....looking at the file /var/lib/mlocate/mlocate.db and
trying to figure out how to look at its contents offline.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://ufo.chicago.il.us/pipermail/ufo/attachments/20150314/d8d41123/attachment.html>