What's accessing my hard drive.

March 6, 2008 7:43 AM

What the blazes is making my hard drive work so hard?

My hard drive light on my Dell Latitude D620 keeps coming on every 5-10s - this is making my fan run like mad and is playing hell with battery life.

I'm having a hard time pinning down what's making it do it. I've tried Diskmon from sysinternals, but all it tells me is that there's drive activity every few seconds, which I'd already figured from the light. I've tried shutting down various programs for a while but this doesn't seem to be helping me pin it down. I don't think it's malware or a virus - scans turn up nothing and I have regularly updated virus software on at all times.

Thoughts? This has only been a problem in the last few weeks, yet I've not changed the system configuration.

posted by Zinger to computers & internet (19 comments total)

Have you tried any of the other sysinternals apps? Especially FileMon or Process Monitor?
posted by JaredSeth at 7:52 AM on March 6, 2008

What operating system are you running?

If it's some version of windows, my bet would be it's the indexing service.
posted by Class Goat at 7:56 AM on March 6, 2008

Is it possible it's the AV software itself.
posted by yerfatma at 7:56 AM on March 6, 2008

In addition to the Windows indexing and antivirus scanning, which are both very good suggestions, look for crapware utilities that might have been installed for peripherals (printers, cameras, scanners, etc.) spend a lot of system resources looking for their appointed peripheral. (I had a Microtek memory resident scanner utility once that crippled my desktop computer if the scanner was not powered on.)
posted by aught at 8:27 AM on March 6, 2008

I had a similar problem and I found the culprit by terminating processes one by one through the task manager.
posted by bluefrog at 8:29 AM on March 6, 2008

I thought it might be the virus software (F-Prot), so I went so far as to temporarily uninstall that but that doesn't seem to be it.

I don't think I've got the stupid indexing services on, as that was an issue once before.

And sorry, duh, yes, I should have mentioned I'm running Win XP, with all the latest updates.
posted by Zinger at 8:31 AM on March 6, 2008

Also look at Windows Desktop Search, Google Desktop, or any other "automatic search" tools.
posted by disclaimer at 8:32 AM on March 6, 2008

Bring up the Windows Task Manager. Click on the Processes tab. Click on the CPU table heading so that the processes are sorted by CPU usage (you might have to do this twice so that it's sorted in descending order). Now whenever a process kicks in, it will shoot to the top of the list, and you can see what corresponds to the disk hits. Then Google the process name to find out more.
posted by richg at 8:59 AM on March 6, 2008

Do you attach a mobile phone to your computer? I find that after I hook up my Nokia to the computer and open up the PC Suite included with the phone and do my business, Windows starts executing some process like crazy every five seconds or so and the only thing I can do is reboot. Since I rarely attach my phone, I've been too lazy to investigate this further.
posted by sic at 9:03 AM on March 6, 2008

I suggest Process Explorer because it can visualize the disk usage and identify the process causing it. Once you run Process Explorer you'll notice the graphs in the top right corner, click on one of them to get a better look. The graph of interest to you is the blue one, if you place your cursor overtop of the graph it will give you details on the programs transferring data on your computer.

You can also bypass the graphs and go View->Select Columns->Process Performance here there are a lot of performance metrics which are of interest to you. I would select I/O History, I/O Read Bytes, I/O Write Bytes, I/O Delta Read Bytes, I/O Delta Write Bytes. With these you should easily be able to isolate the problem program/s. Once you think you've found it double click it to get even more detailed information.
posted by robofunk at 9:09 AM on March 6, 2008 [1 favorite]

You may have tried all this, but...

Search for spyware. Spybot works pretty well. Windows Defender does too.

Look for rogue processes in the Task Manager by hitting Ctrl-Alt-Delete and clicking Task Manager, then the Processes tab. The processes list can be sorted by processor and memory usage. There'll be stuff in there with weird names... google the name if you don't know what they are. A lot of that will be system stuff, but you might be able to kill out spyware that way too.

While you're in there, check your overall memory usage. If you're using too much the memory will swap to the hard drive. Set your page file to System Managed Size, to keep this simple. Advice on the size of your swap space can really vary on what you're doing. (These settings are in Control Panel -> System -> Advanced -> Performance Options)

You should use less than 80% of the drive capacity as a rule. After that you get a lot of excess seek activity. Check for disk fragmentation (this is much less of a problem now, with XP using NTFS, but what the hell). In My Computer, find your hard drive, right click, Properties, Tools, Defragment Now. Check the drive while you're in there. On a long shot, you might have bad blocks that are thrashing. Turn on both options to automatically fix and scan for bad sectors.

My guess is you just have some spyware that's writing a log of your activity. That's pretty common nowadays.
posted by dosterm at 9:10 AM on March 6, 2008

You should probably check to see if the indexing service is still disabled. Sometimes Microsoft updates will reenable things you've disabled, since "obviously" you made a mistake in disabling them. (Doesn't everyone just absolutely love the indexing service?)
posted by Class Goat at 9:29 AM on March 6, 2008

uTorrent and AV software are the usual culprits for me.
posted by beerbajay at 9:36 AM on March 6, 2008

subversion has a filesystem crawler (tsvncache.exe) that absolutely hammered my drive.

turned out that i hadn't set it up, so it was crawling EVERYTHING. i just turned it off, and everything's fine.
posted by klanawa at 11:36 AM on March 6, 2008

If none of the other suggestions work trying shutting off your startup apps. Use msconfig and disable half the list. If it stops then the problem was in that half so enable half of those apps and check again. Repeat until you find the culprit or find that it isn't an app in startup.

My experience with hard drive thrashing apps is that is usually indexers for search and mp3 library scanners.
posted by srboisvert at 1:31 PM on March 6, 2008

Not sure if this will help, but this can happen if the machine does not have enough memory, and is constantly having to swap real memory into virtual memory and back again.
posted by Area Control at 2:43 PM on March 6, 2008

If his machine was thrashing memory, he'd also be noticing a 20-fold drop in responsiveness. Presumably he'd have said so, so it isn't likely that this is the problem.

Anyway, it's trivial to check the "memory usage" graph in the task manager to see if it's greater than the amount of real RAM.
posted by Class Goat at 6:44 PM on March 6, 2008

To clarify the above post, look in the Performance tab of Windows Task Manager. If the Commit Charge Total is greater than the Physical Memory Total, your machine is swapping.
posted by xenyz at 1:57 AM on March 7, 2008

OMG.. I have the exact same problem with a D620. Been going on for about 6 weeks, and haven't solved it yet. Did you have any luck solving this?

- I have suspected the Sprint broadband connection software, google desktop, and it looks like the following processes are clocking a lot of I/O Bytes
- csrss
- lsass
- Dot1Xcfg

Any help will be good.. Short of reformating, not sure what to do. Thanks
posted by totorn at 11:51 PM on April 6, 2008