sudo LC_ALL=C /sbin/tune2fs -l /dev/nvme0n1 |grep 2022
tune2fs 1.46.6-rc1 (12-Sep-2022)
Last mount time: Thu Dec 29 20:05:22 2022
Last write time: Fri Dec 30 11:14:35 2022
Last checked: Wed Aug 31 09:37:57 2022
(It looks like "Last write time" is actually "Last umount time", because it is not refreshed during usage of the FS)
This is handled for example by fake-hwclock package in Debian (also RaspberryPi OS, installed by default) - it saves it in file, and even updates it every hour (so you won't teleport more than a hour back in time after unclean reboot). However, it of course does not work when you mount read-only because you don't want your microSD card to fail.
Interesting! Unfortunately due to write endurance many networking devices mount their filesystem read-only. This means they also sometimes lack a log file describing why the device shut down!
Comments
Back in the day, Unix wrote the time of day in the superblock for the root fs before unmounting it and rebooting.
It still does:
sudo LC_ALL=C /sbin/tune2fs -l /dev/nvme0n1 |grep 2022 tune2fs 1.46.6-rc1 (12-Sep-2022) Last mount time: Thu Dec 29 20:05:22 2022 Last write time: Fri Dec 30 11:14:35 2022 Last checked: Wed Aug 31 09:37:57 2022
(It looks like "Last write time" is actually "Last umount time", because it is not refreshed during usage of the FS)
This is handled for example by fake-hwclock package in Debian (also RaspberryPi OS, installed by default) - it saves it in file, and even updates it every hour (so you won't teleport more than a hour back in time after unclean reboot). However, it of course does not work when you mount read-only because you don't want your microSD card to fail.
Interesting! Unfortunately due to write endurance many networking devices mount their filesystem read-only. This means they also sometimes lack a log file describing why the device shut down!