Originally Posted by knc1
There are only two writable places: /var/local and /mnt/us
Sort of limits where to look (but be sure to look for hidden directories and files).
During operation that is generally correct, but the startup scripts also write to the main partitions when booting both from main and from diags. But they wrap those writes with "mntroot rw" and "mntroot ro" in each case that I have seen.
In diags, various diag tests write in the /opt directory tree (which is on the diags boot partition).
Newer firmwares are also know to DELETE stuff from the main boot partition (such as /usr/local).
And of course, some hacks write to the main partition as well (to install startup scripts or keys).
But most changes are made to /var/local or /mnt/us, as you said.