Is it possible to detect if files on a drive were changed without scanning the drive?

[Oren Tirosh]

> After connecting a drive to the system (via USB
> or IDE) I would like to be able to see within seconds
> if there were changes in the file system of that drive
> since last check (250 GB drive with about four million
> files on it).

Whenever a file is modified the last modification time of the directory
containing it is also set. I'm not sure if the root directory itself
has a last modification time field but you can just store and compared
the last mod time of all subdirectories directly under the root
directory.

If you trust the clock of all machines mounting this drives is set
correctly (including time zone) you can store just a single timestamp
and compare for files or directories modified after that time.
Otherwise you will need to store and compare for any changes, not just
going forward.

  Oren