On May 7, 1:10 pm, martin f krafft <madd...@debian.org> wrote: > > use integrit/aide/tripwire > > only useful with read-only media OK, I don't get it if the media is read-only none can alter it so you don't really need tripwire. But if the media is writable so changes can be made you need to run tripwire to check your files. Where am I wrong?