Have you ever noticed that when you’re not using your computer or even not “intensively” using it, it seems like your hard drive is really busy as though it is searching for something? The hard disk drive LED will start flashing and sometimes you can even hear that the hard drive is grinding. Funny thing is this can still happen even if you have closed all running programs. If you’re using a laptop, it’s even worse because the fan will start spinning like mad when the hard drive or processor is working hard and this will shorten the battery life!
Most of the time the culprits that cause your hard drive to work in the background are things like anti-virus software, anti-spyware software, instant messenger programs (IM), and Microsoft’s own indexing service. It’s not so bad if a legitimate program is making your hard drive work but you’ll never know among all the legitimate activity if a hacker is doing a search on your hard drive looking for confidential information!
Unfortunately, Microsoft didn’t include a tool to diagnose and check what program is secretly accessing your hard drive. The built-in Windows Task Manager doesn’t show you anything at all other than CPU and Memory Usage. So I am going to show you how to find out what process is busy reading and writing your hard drive when you’re not causing it.
Here are two tools that can check what is accessing your hard drive.
1. Process Monitor
Process Monitor by SysInternals watches and displays a comprehensive amount of file system activity on a system in real-time. Its advanced capabilities make it a powerful tool for exploring the way Windows works, seeing how applications use the files and DLLs as well as how they interact with the registry, or tracking down problems in system or application file configurations. Process Monitor’s timestamping feature will show you precisely when every open, read, write or delete, happens, and its Result column tells you the outcome.
Process Monitor is so easy to use that you’ll get a great idea of what is going on under the hood of your system within minutes. It begins monitoring when you start it, and its output window can be saved to a file for off-line viewing. There is a full search capability, and if you find that you’re getting information overload, simply set up one or more filters.
For a more detailed look at disk activity, go to the Tools menu -> File Summary… and you will have a vast amount of information about what exactly has been accessing your hard drive and the amount of data any file has read or written. There is also a tab where the disk activity can be sorted by folder. This is useful to detect if the disk is being accessed from non standard locations such as the Windows Temp folder. The Extension tab can sort everything by the file that has accessed the drive’s extension. Unrecognized files with an extension type like VBS, BAT, COM or EXE can then be traced to see if they are using the drive to perhaps cause problems.
There is a similar tool called DiskMon, which is also developed by the same author SysInternals. It can log and display all hard disk activity on a Windows system but it only tells you which sector is being read or written. This makes it not easy to tell which file or program is accessing your hard drive using DiskMon alone.
2. AnVir Task Manager
AnVir Task Manager Free is freeware utility software that gives users a comprehensive set of tools to put them in full control of their computer. It gives you detailed information about every process that is running, and about applications running automatically on Windows startup including all hidden applications.
AnVir Task Manager is a very advanced yet simple to use Task Manager. It has a feature called “Disk Load” on the Processes tab where you can see the rate of disk activity which summarizes the amount of data read, written and transferred by a process per second.