Raspberry Pi OS • Inodes of files on microSD change for no apperent reason

Hello,

I am using a Raspberrypi 4 as a NAS (headless) and was also experimenting with rootkit hunter, a software for IT-Security.
It tracks file changes and sends alerts, when it found something suspicious.

For some time now, it reports that the inode numbers from some files have changed, but I was not able to correlate the changes with updates or other uses of these files.
My theory is, that the controller on the microSD Card is responsible, because the controller on the SDcard has to deal with wear of memory blocks in the background, and some how it messes with the inode numbers from the filesystem.

Any Ideas what might be the cause?

System:
Raspberry Pi 4 Model B Rev 1.5
Debian GNU/Linux 11 (bullseye)
Kernel 6.1.21-v8+ #1642 SMP PREEMPT Mon Apr 3 17:24:16 BST aarch64

Here the report from rkhunter:
---------------------------------------------------------------------
Warning: The file properties have changed:
File: /usr/bin/curl
Current inode: 11413 Stored inode: 20826
Current file modification time: 1724296935 (22-Aug-2024 05:22:15)
Stored file modification time : 1712710820 (10-Apr-2024 03:00:20)
Warning: The file properties have changed:
File: /usr/bin/ldd
Current inode: 8917 Stored inode: 8081
Current file modification time: 1725289858 (02-Sep-2024 17:10:58)
Stored file modification time : 1715067254 (07-Mai-2024 09:34:14)
Warning: The file properties have changed:
File: /usr/bin/netstat
Current hash: 8df931837483efdee3f28cef22fd17d405772a8f894fdd982df091169a31f385
Stored hash : 87c7e0e0d478c1aff5602f50ceeaf09b87b107e9999fdaa1cccfacc13e5327bb
Current inode: 1893 Stored inode: 1864
Current file modification time: 1724077800 (19-Aug-2024 16:30:00)
Stored file modification time : 1601631064 (02-Okt-2020 11:31:04)
Warning: The file properties have changed:
File: /usr/bin/systemd
Current hash: e4c8925939e499e6180ff9aaffb1031d6ceaae09da1e563f16bf117d1eb47ae1
Stored hash : d33b2d3f945eca9e9ad1d3c80417fd73af084b09cead69b276398acabf2acce7
Current inode: 35658 Stored inode: 46174
Current file modification time: 1724612715 (25-Aug-2024 21:05:15)
Stored file modification time : 1716814923 (27-Mai-2024 15:02:03)
Warning: The file properties have changed:
File: /usr/bin/systemctl
Current hash: a456ad79ef1ce3a31fc8e4f97897398ca497db9f9782869f4f0c113d96a2a383
Stored hash : 0089756931c7b7f5d3ef8ee2344764f506e09873517cee0553f25f14cc16b369
Current inode: 15944 Stored inode: 30050
Current file modification time: 1724612715 (25-Aug-2024 21:05:15)
Stored file modification time : 1716814923 (27-Mai-2024 15:02:03)
Warning: The file properties have changed:
File: /usr/sbin/ifconfig
Current hash: 07e202986f8fa1ffd3bd94ef8eecd60efaa72dd1c59f034f347e060232c9a913
Stored hash : f70a3cedbfa2959171ff822f4b8bad0424f0a766d7780b914d364d1b5ab98223
Current inode: 4067 Stored inode: 15940
Current file modification time: 1724077800 (19-Aug-2024 16:30:00)
Stored file modification time : 1601631064 (02-Okt-2020 11:31:04)
Warning: The file properties have changed:
File: /usr/sbin/init
Current hash: e4c8925939e499e6180ff9aaffb1031d6ceaae09da1e563f16bf117d1eb47ae1
Stored hash : d33b2d3f945eca9e9ad1d3c80417fd73af084b09cead69b276398acabf2acce7
Current inode: 11657 Stored inode: 11036
Current file modification time: 1724612715 (25-Aug-2024 21:05:15)
Stored file modification time : 1716814923 (27-Mai-2024 15:02:03)
Warning: The file properties have changed:
File: /usr/sbin/route
Current hash: 002b4e7d4d0f7087924d24cc1ba400f18a62a0e0fbd28d37ddfef4a92e0f9e70
Stored hash : b390b4bd24d8f67ff3ceed55d20ffdf0ac7192b0cb9fd5ea50e304c18ac53753
Current inode: 15992 Stored inode: 16020
Current file modification time: 1724077800 (19-Aug-2024 16:30:00)
Stored file modification time : 1601631064 (02-Okt-2020 11:31:04)
Warning: The file properties have changed:
File: /usr/sbin/runlevel Current hash: a456ad79ef1ce3a31fc8e4f97897398ca497db9f9782869f4f0c113d96a2a383
Stored hash : 0089756931c7b7f5d3ef8ee2344764f506e09873517cee0553f25f14cc16b369
Current inode: 11670 Stored inode: 11622
Current file modification time: 1724612715 (25-Aug-2024 21:05:15)
Stored file modification time : 1716814923 (27-Mai-2024 15:02:03)
Warning: The file properties have changed:
File: /usr/lib/systemd/systemd
Current hash: e4c8925939e499e6180ff9aaffb1031d6ceaae09da1e563f16bf117d1eb47ae1
Stored hash : d33b2d3f945eca9e9ad1d3c80417fd73af084b09cead69b276398acabf2acce7
Current inode: 35224 Stored inode: 35197
Current file modification time: 1724612715 (25-Aug-2024 21:05:15)
Stored file modification time : 1716814923 (27-Mai-2024 15:02:03)

Statistics: Posted by ChiefNakamura — Fri Sep 13, 2024 10:47 am

---