In article <[🔎] 20050622202043.GA21612@antiochcomputerconsulting.com> you wrote: > You could always run tripwire on the mounted file system, unmount it, > change your block, remount it, and run a tripwire check. This should > identify *WHICH* file changed. he has only one file and this was unaltered, the question is why. Bernd