Helping people with computers... one answer at a time.
Unexpected hard disk activity isn't unusual. I'll show you how to use a free monitoring tool to determine what program is causing it.
Why, when I'm doing nothing at all, will my hard disk suddenly start thrashing?
•
It could be for many reasons. The most common are antivirus tools or the system indexing service, if it's enabled.
To find out what's happening on your system, we'll use fairly powerful system monitoring tool called Procmon.
•
Process Monitor
Process Monitor, or simply Procmon, is a free tool that you can download here from Microsoft. (It's different from, and should not be confused with, Process Explorer.) It's a very sophisticated system monitoring tool that works by:
-
Collecting data, called "events", while your system runs – presumably while you're experiencing whatever it is that you're attempting to understand.
-
Allowing you to examine the individual events.
-
Summarizing the event data in useful ways.
It's that last feature that we'll focus on here.
Running Procmon
When you run Procmon, you'll probably be surprised by all the things your system is doing while you're not doing anything.
As long as the disk isn't thrashing (it's possible that it's not even being hit at this point), it's all quite normal. Let Procmon run.
As soon as you hear your hard disk thrashing when you think it shouldn't be, let it run for a few seconds and then press CTRL+E in Procmon to stop the capture.
In among all of the other events are some relating to disk I/O. If you like, you can scroll through the events to see what's happening, but I have a better solution.
File summary...
Click the Tools menu and then the File Summary... item. This gives you a report of the file I/O activity within the recorded data:
The default is sorted by Total Events. Scroll the data to the left to see the rightmost Path column (which you can also widen by grabbing its right-most column header bar and dragging right).
You can also sort by any of the other column headers in the File Summary dialog so you can see which file took the most time, had the most reads, writes, or any of several other activities. I would assume that for simple "Why is my disk thrashing?" analysis, the default "Total Events" is likely to be the best place to start.
Expected or not?
What we may determine is that the results that you find are indeed expected behavior for your system. You may recognize a process – perhaps your anti-malware tools, perhaps the system indexing service, perhaps something else that you recognize – and simply be able to say, "Oh, it's that," and take no further action.
On the other hand, you might also decide that whatever is running is unwanted and work through the steps to turn it off or remove it. Exactly what those steps are, of course, will depend on exactly who the culprit turns out to be.
(This is an update to an article originally published August 10, 2003.)
Article C1828 * November 15, 2011 « »
Leo A. Notenboom has been playing with computers since he
was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed.
After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers
to common computer and technical questions. More about Leo.
April 21, 2009 12:20 PM
I ran process monitor on my wife's computer because its HD keeps running even though I have shut off indexing and defrag. It has hundreds of entries where snippit is opened and closed. She doesn't even know what snippit is. I do use it on my computer and have months ago on hers. Is it likely that there is some sort of key logging or similar spy process going on?
December 17, 2009 4:26 AM
I had a similar problem. My hard drive would thrash constantly on a pretty fast Core i7 compy with 12Gig RAM. It was infuriating. I searched the intertubes and came across this thread. I tried what was suggested, but it didn't fix my problem. I did fix my problem though.
It turns out my outlook.ost file was too big. I found out from Microsoft that you may experience issues with .ost files over 2Gig. Well, mine was over 19Gig!
I closed down Outlook. Then I just renamed the file outlook_bak20091216.ost. I then launched Outlook and it rebuilt the outlook.ost file from the Exchange server. My new outlook.ost file is under 1Gig. Better yet, no more hard drive thrashing.
January 23, 2010 4:25 PM
My harddrive will start thrashing, and the screen goes blank. I can hear the processor cooling fan kick into high speed. This doesnt happen very often but it will do it at an idle or when im working. I am running xp with sp3. I do have spyware/virus programs. I am cut off from accessing the computer when this happens so I have no idea what is causing it or what happens as I have to pull the plug to stop it. I let it run for 10 mins one time to see if it would stop.
Any ideas where I should start? Will "filemon" record all activity even if I pull the plug?
June 9, 2011 10:42 AM
Aside from doing the routine maintenance items; i.e. disk defrag, registry cleaning, deleting temp files, I recommend doing the this. Uninstall your Anti-virus program and reboot. If this doesn't give you back a new computer high performance I would be shocked. Sure, it could be your hard drive going but what do you think causes most hard drive failures, misuse - drive thrashing, multiple PC restarts (power bumps) viruses and poor hard drive maintenance.
If you are using McAfee or Norton, especially the ones custom tailored for Verizon and Comcast like I was using you should gain back a stable PC if you uninstall them. I replaced Norton with Avira and I no longer have PC issues.
November 20, 2011 10:12 AM
Leo,
I've downloaded the zip files for both Process Monitor and Process Explorer to my Downloads folder. After extracting, the exe files run from there just fine. This is nice for portability, as I can stick them on a USB drive and troubleshoot other PCs.
For my own PC (Win7 Home), I'd like to give them a more permanent home, and wonder what would be most logical. Program Files, Program Files (x86), Downloaded Program Files, system, System32, some other existing folder, or a Utilities folder I create myself? What do you do?
20-Nov-2011
•
Comments on this entry are closed.
If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.
If you don't find your answer, head out to http://askleo.com/ask to ask your question.