Keeping your SD card safe and secure by knowing when it was last accessed

Learn how to check the last time your Raspberry Pi SD card was modified or accessed using a few simple terminal commands in this step-by-step guide. …


Updated August 2, 2023

Need help with your Raspberry Pi?
Contact Me!

Do you love silly Raspberry Pi Projects?
Check out my this YouTube Channel!


Learn how to check the last time your Raspberry Pi SD card was modified or accessed using a few simple terminal commands in this step-by-step guide.

Are you using a Raspberry Pi with an SD card for your project? Do you want to know when it was last accessed or modified? This is important for security reasons and to ensure that your device remains safe from unauthorized access or tampering. In this article, we will show you how to check the last time your Raspberry Pi SD card was accessed or modified using a few simple terminal commands.

To begin with, you need to have an SSH connection established with your Raspberry Pi. If you don’t know how to do this, you can refer to our previous article on setting up an SSH connection. Once the connection is established, follow these steps:

  1. Open a terminal window on your local machine and type ssh pi@your_raspberry_pi_ip to connect to your Raspberry Pi (replace “your_raspberry_pi_ip” with the actual IP address of your device). Enter the password when prompted.
  2. Once connected, navigate to the SD card mount point on your Raspberry Pi using cd /media/pi/ or wherever you have mounted your SD card.
  3. To check the last time the SD card was accessed, run the following command:
    ls -lu | grep sd*

    This will display a list of all files and directories in the current directory with their access times. Look for the “Access” column which shows the last access time for each file or folder. In this case, we are grepping (searching) for any file or folder that starts with “sd”, as this is typically how SD cards are mounted on a Raspberry Pi.

  4. To check the last time the SD card was modified, run:
    ls -lc | grep sd*

    This will display a list of all files and directories in the current directory with their modification times. Look for the “Modify” column which shows the last modification time for each file or folder. Again, we are grepping (searching) for any file or folder that starts with “sd”.

  5. To check both access and modification times together, run:
    ls -luc | grep sd*

    This will display a list of all files and directories in the current directory with their access and modification times. Look for the “Access” and “Modify” columns which show the last access and modification time for each file or folder, respectively.

That’s it! You now know how to check the last time your Raspberry Pi SD card was accessed or modified using a few simple terminal commands. Keep in mind that these times are in UTC format, so you may need to convert them to your local timezone if necessary.