Some time back i moved from vmware to virtualbox, and am currently wondering if there are some old vmware files i can remove. Virtualbox uses the old vmware disk files, so first i checked via atime and lsof.
Why does atime not show all the files that lsof shows were open? Steps were; 1. start vm 2. create and save dummy file in vm 3. run lsof on vm PID 4. shut down mv 5. run find to see which files were accessed # lsof -p 2299 | grep 'VIRTUALS/Win-10-x64' VirtualBo 2299 adam 42u REG 259,2 2453 10095159 /home/adam/VIRTUALS/Win-10-x64/Windows 7 x64.vmdk VirtualBo 2299 adam 44u REG 259,2 2146762752 10094024 /home/adam/VIRTUALS/Win-10-x64/Windows 7 x64-s001.vmdk VirtualBo 2299 adam 45u REG 259,2 2146762752 10094071 /home/adam/VIRTUALS/Win-10-x64/Windows 7 x64-s002.vmdk VirtualBo 2299 adam 46u REG 259,2 2146762752 10094011 /home/adam/VIRTUALS/Win-10-x64/Windows 7 x64-s003.vmdk VirtualBo 2299 adam 47u REG 259,2 2146762752 10094108 /home/adam/VIRTUALS/Win-10-x64/Windows 7 x64-s004.vmdk VirtualBo 2299 adam 48u REG 259,2 2146762752 10094076 /home/adam/VIRTUALS/Win-10-x64/Windows 7 x64-s005.vmdk VirtualBo 2299 adam 49u REG 259,2 2146762752 10094127 /home/adam/VIRTUALS/Win-10-x64/Windows 7 x64-s006.vmdk VirtualBo 2299 adam 50u REG 259,2 2146762752 10094050 /home/adam/VIRTUALS/Win-10-x64/Windows 7 x64-s007.vmdk VirtualBo 2299 adam 51u REG 259,2 2146762752 10094087 /home/adam/VIRTUALS/Win-10-x64/Windows 7 x64-s008.vmdk VirtualBo 2299 adam 52u REG 259,2 2146762752 10094031 /home/adam/VIRTUALS/Win-10-x64/Windows 7 x64-s009.vmdk VirtualBo 2299 adam 53u REG 259,2 2146762752 10094102 /home/adam/VIRTUALS/Win-10-x64/Windows 7 x64-s010.vmdk VirtualBo 2299 adam 54u REG 259,2 2146762752 10094021 <snip> # find VIRTUALS/Win10-vbox/ -atime -1 -type f VIRTUALS/Win10-vbox/Win10-vbox.vbox VIRTUALS/Win10-vbox/Logs/VBox.log VIRTUALS/Win10-vbox/Logs/VBox.log.1 VIRTUALS/Win10-vbox/Win10-vbox.vbox-prev #