We suspect that one of our CentOS server has been compromised because someone left a filesystem mounted accidentally (its an old empty partition we don't use anymore, in a home/unusual_name directory name. We think someone mounted it to check what's inside and forgot to dismount)
No mount command trace in .bash_history nor /var/log/messages.
We have several login auditories so we can use those timestamps to know if we can catch who left that filesystem mounted, but how can we know when that filesystem was mounted?
Regards
