What files, what events?
I recently entered the old system.
I see automatic mounting of a certain partition every hour.
I was scared to have a virus.
I seen this was every hour. From log I seen this was mounted from crontab. From ' ls /etc/cron* ' I seen all files.
From /etc/cron.d in file I found this was only Timeshift app.
I checked and I had there system snapshots set.
This is the reason why the partition was automatically mounted.
So I should monitor path /media/user_name/
