Why is my disk busy even though I'm doing nothing?
Hi everyone.
Leo Notenboom here for AskLeo.com. Let's get right to this question.
Why, when I'm doing nothing at all?
Will my hard disk suddenly start thrashing?
And by thrashing, what this means is your hard disk is busy.
It's doing a bunch of reading and writing and all sorts of things.
Typically that is evident by either noise from your hard disk.
If you've got a spinning platter hard disk, you can hear the disk head moving
back and forth, or there may be an activity light on your
system that is always on or flashing rapidly.
Bottom line here is that the system is doing something, but you aren't.
How do you find out what the system is doing?
There's an app for that.
Let's go ahead and take a look at Windows Eleven.
So what we're using are the Sysinternal Tools.
I'm going to fire up the Microsoft Store
just so that you can see where this comes from.
If I go to Sysinternal, I can just look up Sysinternal Suite.
It's free.
In my case, I already have it installed,
but otherwise there would be an install button here or something like that.
This is what you want.
This will install a number of very useful
tools that I recommend just having available.
Like I said, they're free, they're useful,
and they are things that will help us diagnose situations such as this.
So we'll go ahead and get rid of the Microsoft Store.
Where you'll find these tools is in either of two places.
I think it depends on your version of Windows.
In both cases, you'll go to all apps.
In my case in Windows Eleven.
Here there is a sub menu called
Sysinternal Suite, and that's where we'll find a number of different tools.
They're interesting. Play with them if you like.
The one that we care about is Process Monitor.
I want to make sure to differentiate this from Process Explorer,
which is a tool I talk about often, more often actually, than Process Monitor.
Process Monitor is what we want to use here today.
Now, I did say that you might find it in a different place on my other systems.
I have also seen this show up not in a sub
menu for Sysinternal Suite, but rather Process Monitor would be under the P's.
So make sure to look in both places to find the tool.
Process Monitor, we're going to run it now.
I'm going to just run it.
When you run it for the first time,
it will start collecting information right away.
When I run it for the second time or
multiple times since I've done this before, it's actually going to bring up a
dialogue that says, hey, you've had some filters set up before.
You can ignore this. You can actually ignore this completely.
Just hit okay.
And now what's happening is Process Monitor.
If you take a look closely at the bottom of its window.
It's collecting events.
These are not Event Viewer events.
This is a different kind of event.
This is all of the activity that's currently happening on this system.
And you can see there's a lot of events happening at a pretty good clip.
I don't have any disk activity yet, not excessive disk activity.
So let me first simulate some disk activity.
You can see I've got the Windows command prompt ready to go here.
And I'm just going to go Du, which is another tool that was installed
with Sysinternals, and that's giving me disk usage.
But you can see by doing that, it's hitting the hard disk.
It's actually hitting the hard disk fairly quickly.
What I would have you do after running
Process Explorer is to pay attention to when you see your disk getting hit.
When you see that activity being very busy
after it's been happening for a few seconds, click on this icon.
This is the capture icon.
You can also use Control E,
as you can see here, to stop the collection of information.
You can see now at the bottom of that window, we've stopped collecting events.
There are now 1.3 million events that have been collected.
That's a lot of events.
We can scroll through this window and we
can see the 881,000 that have already been collected.
Now, you can see here right away that Du is showing up a lot.
That's the tool that I ran.
And as it turns out, it's still running.
But if you look at the very top here,
you'll see that there are a lot of other kinds of activities.
There's Registry stuff.
There's file stuff going on.
There's this Process Profiling stuff going on.
That's all stuff we don't care about,
that has very little, if anything, to do with disk activity.
These five icons right here, these all represent automatic filters.
These are all saying currently,
they're all saying they all default to show me this kind of activity.
So what I'm going to do is click on this
first one that says Show Registry Activity.
It's unapplying, that filter.
Now we are going to see all of the events without Registry activity.
This one over here, that's Process Profiling.
We're now going to turn off
Process Profiling, the filter, so that now we're only seeing the other three items.
This one show Process and thread activity.
Like when programs begin and end.
We're going to turn that off.
Now we're going to see even fewer events.
And finally we're going to look at this one.
That Shows network activity.
I'm going to turn that one off.
You can see we actually have some Chrome
activity here doing UDP sends, which is a kind of network activity.
What's left is this one, file system Activity.
That's what we care about.
That's your hard disk being used.
Now you can see here that at the beginning we were seeing Ms mpeng Exe.
That's the Microsoft Malware Protection Engine.
That's actually a very common cause
of disk activity, particularly after you've signed in.
It takes a while to run through the system and scan for any newly added malware or
any files that need to be scanned for malware.
But that's at the top of our list.
That's not what we were seeing necessarily
when we were seeing this big heavy disk activity.
What we'll do this time, I'll scroll down to the bottom and you can
see now that we've got all of this information related to Du XE.
In my case, that's the tool that I ran that does a lot of disk activity.
I know what it is. I know that it was there.
I ran it to simulate disk activity.
What you might find in a scenario like this is after having scanned for only file
system activity, you may find some other program running here.
You might find something that oh, it's MSNP engine.
Great, I know what it is.
Or it's the content indexer or it's something else where once you see it,
you'll understand that, yeah, that makes sense.
That would be doing heavy disc activity for a while.
We'll just let it run.
We won't make any changes.
However, you may also find things here that you didn't expect.
You may find things that you recognize, but you don't necessarily want to be
having that kind of an impact on your system.
That means you may need to go
in and change the configuration option for whatever it is you find.
Worst case, you might even uninstall whatever it is you find because you
realize that it's not worth having to deal with this heavy disk activity.
Finally, and I know the one that everybody
is always concerned about is malware processes that you don't recognize.
What you want to do is right click on the thing you don't recognize.
You can see properties and they'll tell you some other information.
The one to click on is Search Online that will fire up a browser
and essentially allow you to then type in the thing you're searching for.
Here in our case, we can see that this is the disk usage utility.
You may find other search results.
As always, be skeptical of search results.
A lot of websites explicitly try to target this kind of a search where you've got
a random executable or a random thing and they will say, is this malware?
And they'll encourage you to download
and run their antimalware tool or their scanner.
You don't need to do any of that.
What you're looking for here is specific
information about exactly what that thing is.
Nothing more, nothing less.
You don't want to be running additional tools, not yet.
Once you understand what that thing is, once you've done the research
to understand what it is that is hitting your hard disk so hard,
you may find that it is still something that you recognize or something you
suddenly realize, oh yeah, that's this weirdly named Executable,
but it's part of this application that I've installed.
Again, if you don't recognize it or if it
comes up as being clearly malware, then of course, you want to do a full scan
using whatever malware solution you already have installed.
And I say that because, like I said, many of these websites are misleading,
and they will try to get you to install other things.
You don't necessarily need to do that,
but this is how you find out what's happening on your machine.
This is how you find out what's using all
your disk, what's thrashing the hard disk so hard it's running Process monitor
and then filtering by file system activity to see exactly what the heck is going on.
Hope that's helpful.
As you can tell, it's a really useful and powerful tool.
We've really only scratched the surface of it.
But this specific question gets answered fairly quickly by using this tool.
For updates, for comments, for related links and more,
visit Ask Leo.com/1828. I'm leo Notenboom and this is AskLeo.com. Thanks for watching.