Why, when I’m doing nothing at all, will my hard disk suddenly start thrashing?

Unexpected hard disk activity isn't unusual. I'll show you how to use a free monitoring tool to determine what program is causing it.

//

Why, when I’m doing nothing at all, will my hard disk suddenly start thrashing?

It could be for many reasons. The most common are antivirus tools or the system indexing service, if it’s enabled.

To find out what’s happening on your system, we’ll use fairly powerful system monitoring tool called Procmon.

Process Monitor

Process Monitor, or simply Procmon, is a free tool that you can download here from Microsoft. (It’s different from, and should not be confused with, Process Explorer.) It’s a very sophisticated system monitoring tool that works by:

  • Collecting data, called “events”, while your system runs – presumably while you’re experiencing whatever it is that you’re attempting to understand.
  • Allowing you to examine the individual events.
  • Summarizing the event data in useful ways.

It’s that last feature that we’ll focus on here.

Running Procmon

When you run Procmon, you’ll probably be surprised by all the things your system is doing while you’re not doing anything.

Process Monitor Initial Screen

As long as the disk isn’t thrashing (it’s possible that it’s not even being hit at this point), it’s all quite normal. Let Procmon run.

As soon as you hear your hard disk thrashing when you think it shouldn’t be, let it run for a few seconds and then press CTRL+E in Procmon to stop the capture.

In among all of the other events are some relating to disk I/O. If you like, you can scroll through the events to see what’s happening, but I have a better solution.

File summary…

Click the Tools menu and then the File Summary… item. This gives you a report of the file I/O activity within the recorded data:

Process Monitor file summary

The default is sorted by Total Events. Scroll the data to the left to see the rightmost Path column (which you can also widen by grabbing its right-most column header bar and dragging right).

Process Monitor file summary showing Path

You can also sort by any of the other column headers in the File Summary dialog so you can see which file took the most time, had the most reads, writes, or any of several other activities. I would assume that for simple “Why is my disk thrashing?” analysis, the default “Total Events” is likely to be the best place to start.

Expected or not?

What we may determine is that the results that you find are indeed expected behavior for your system. You may recognize a process – perhaps your anti-malware tools, perhaps the system indexing service, perhaps something else that you recognize – and simply be able to say, “Oh, it’s that,” and take no further action.

On the other hand, you might also decide that whatever is running is unwanted and work through the steps to turn it off or remove it. Exactly what those steps are, of course, will depend on exactly who the culprit turns out to be.

(This is an update to an article originally published August 10, 2003.)

There are 18 comments:

  1. LeoN Reply

    A *new* common cause is Windows XP’s System Restore. It monitors changes to a wide range of files and squirrels away restore information. This often looks like unexpected disk activity as it does so.

  2. thomas Reply

    PC very slow, upto 3 mins opening or closing progs prog seems to “wash” down the screen, icons disappear leaving only background pic for 5-10 secs, then reappear); hardisk access light almost continuously on, etc.(1)Resorted to original config. using System Restore, but initial improvement, then back to SLOW;(2)Configured WinXP for best performance, with virtual memory set at 754 MB (min) and 1024 MB (max) as per suggestions of HP customer support;(3) Virus checks (Norton, AVG) are clean;(4) SpybotS&D and Ad-Aware cleaned adware/spyware and now show clean;(5) Used a RegCleaner to clean the system without alteration;(6)installed and enabled firewall (successively by Norton, WinXP and ZoneAlarm Pro);(7) at HP customer support’s suggestion, closed all startup progs except antivirus and firewall, used Disk Cleaner & Defrag, then restarted the pc. Even uninstalled some progs I didn’t use frequently, all to no avail; (8)HD capacity shows drive C is 29% free (9.7 GB) and drive D 15% free at 6

  3. anakha Reply

    Only 128mb of ram under WinXP is likely to be one of your problems. Your swap file is consuming it all. Buy at least 512mb of ram, preferably 1gb to run XP. You likely have an onboard video card which is consuming 32mb of your system’s ram which is why only 96mb appears under Windows. Does your motherboard have an AGP port? If so, I’d recommend buying a videocard for it. Check whether the motherboard supports AGP 1x / 2x / 4x / or 8x and buy a compatible video card.

    Your hard drive will thrash because you’ve told it to have 784mb minimum swap file. The access time to your hard drive is magnitudes slower than for your ram. Hence your system runs like a dog.

  4. Eric Reply

    My Pc’s hard disk is still 85% full after all cleaning and removal of non-necessities. After defrag. there is not very much free space leftover either. I removed a bunch of media files and it seemed like I had less space after I erased them. How can I clean it up without compromising the programs and files that I have(which isn’t very many).Thanx for your help.

  5. Peter Reply

    Nicely done Leo. Systm restore was using a LOT of resources. All is quiet now…

    Thanks,

    P.

  6. Simon Reply

    Hello Leo & Everyone

    My hard disk has started thrashing whenever Outlook 2003 has been running on idle for a few minutes. If I close Outlook 2003 the disk stops thrashing.

    I tried FileMon and captured the screen as soon as the thrashing started – it was full of the line “OUTLOOK.EXE:2144″

    The machine is running Windows 2000 Pro with Service Pack 4. It has 1.5Gb of RAM and the hard drive is a 123Gb IBM. Can anyone help me?

    Many thanks

    Simon.

  7. Leo Reply

    Actually, try letting it “thrash” for a while. Outlook compacts its PST file in the background at idle time. At some point the file will have been compacted, and the thrashing should stop. (And technically it’s not thrashing … unless it somehow impacts your ability to do other things.) Conversely you could force compaction and see if that makes the thrashing stop as well.

  8. Andrew Goodall Reply

    Hello Leo,
    My laptop has been thrashing the HD, Also MS WORD won’t open and after it tries it leaves a rectangle of screen that does not repaint on the desktop also Norton Internet security 2006 does not open. I have phoned Symantec and run SYMNRT.exe and reinstalled Norton Internet security 2006 and reinstalled Norton Ghost 10 and reinstalled Word 2003 pro but I am right back at the starting point. Ctl Alt Del does not shut the computer down so I have to manually shut it down. The last time I restarted the laptop the screen was black so I manually shutdown again, after leaving the laptop shutdown for an hour I restarted it and it opened fine but the above problems are still there any help appreciated.
    My laptop specs are
    990 Megabytes Installed Memory, Slot ‘U5′ has 512 MB, Slot ‘U6′ has 512, Windows XP Professional Service Pack 2 (build 2600), 2.67 gigahertz Intel Pentium 4, 8 kilobyte primary memory, cache, 512 kilobyte secondary memory cache, 40.00 Gigabytes Usable Hard Drive Capacity, 26.93 Gigabytes Hard Drive Free Space, SiS M650 [Display adapter]Default Monitor,

  9. Andrew Goodall Reply

    I believe it is Norton Antivirus 2006 Autoupdate program that is stuck and is causing problems. Symantec who own the product won’t help find the answer without a 39.95 Euro charge and suggested I contact a local engineer to get my problem sorted. Any help appreciated…

  10. Cec Reply

    If your machine is tweaked to perfection, and you have not disabled optimise hard drive on idle, and you have smallish clusters and or lots of data on your drives, defrag hangs.

    Norton 2006, Outlook cleanup, Outlook Express Cleanup, Scheduled Disk Doctor defragmenting, Viruses and Spyware also do create the same disk slow scenario.

    Personally, I disable deframgenting when idle, format my drives with 64K clusters (lose a bit of space but pickup loads of disk speed), and defrag via bat file on startup.

    It’s a good idea to disable system restore on non essential drives. I actually don’t use it, as my OS is installed on a partition, and Documents and Settings and data files are on another, that is backed up. On system failure, I reinstall the OS and programs, do some registry tweaks, and point my data files to certain folders, and I’m back in business.

    I’ve had so many problems with Windows on our network the past month. Viruses have been on the increase. I’m moving some machines over to Linux and running Windows in a virtual machine for certain applications. I will still however need a single Windows dedicated machine for certain software.

  11. Anne Dakmak Reply

    All the above suggestions are ‘over my head’ so, I guess I will have to listen to the growling that is called thrashing by the literate above. I, too, wonder if this is taking up disk space which seems to be decreasing as time goes by and I do not add downloads or new programs. Defrag.,scanned often.

  12. James Baring Reply

    To stop thrashing hard drive in Windows XP, alter the setting of memory from the default (adjust for best performance of programs) to ‘adjust for best performance of system cache’. There are no bad side effects.

  13. John P. Brown Reply

    I ran process monitor on my wife’s computer because its HD keeps running even though I have shut off indexing and defrag. It has hundreds of entries where snippit is opened and closed. She doesn’t even know what snippit is. I do use it on my computer and have months ago on hers. Is it likely that there is some sort of key logging or similar spy process going on?

  14. willgill Reply

    I had a similar problem. My hard drive would thrash constantly on a pretty fast Core i7 compy with 12Gig RAM. It was infuriating. I searched the intertubes and came across this thread. I tried what was suggested, but it didn’t fix my problem. I did fix my problem though.

    It turns out my outlook.ost file was too big. I found out from Microsoft that you may experience issues with .ost files over 2Gig. Well, mine was over 19Gig!

    I closed down Outlook. Then I just renamed the file outlook_bak20091216.ost. I then launched Outlook and it rebuilt the outlook.ost file from the Exchange server. My new outlook.ost file is under 1Gig. Better yet, no more hard drive thrashing.

  15. Joe Harper Reply

    My harddrive will start thrashing, and the screen goes blank. I can hear the processor cooling fan kick into high speed. This doesnt happen very often but it will do it at an idle or when im working. I am running xp with sp3. I do have spyware/virus programs. I am cut off from accessing the computer when this happens so I have no idea what is causing it or what happens as I have to pull the plug to stop it. I let it run for 10 mins one time to see if it would stop.
    Any ideas where I should start? Will “filemon” record all activity even if I pull the plug?

  16. Mike McCormick Reply

    Aside from doing the routine maintenance items; i.e. disk defrag, registry cleaning, deleting temp files, I recommend doing the this. Uninstall your Anti-virus program and reboot. If this doesn’t give you back a new computer high performance I would be shocked. Sure, it could be your hard drive going but what do you think causes most hard drive failures, misuse – drive thrashing, multiple PC restarts (power bumps) viruses and poor hard drive maintenance.

    If you are using McAfee or Norton, especially the ones custom tailored for Verizon and Comcast like I was using you should gain back a stable PC if you uninstall them. I replaced Norton with Avira and I no longer have PC issues.

  17. Douglas Swehla Reply

    Leo,

    I’ve downloaded the zip files for both Process Monitor and Process Explorer to my Downloads folder. After extracting, the exe files run from there just fine. This is nice for portability, as I can stick them on a USB drive and troubleshoot other PCs.

    For my own PC (Win7 Home), I’d like to give them a more permanent home, and wonder what would be most logical. Program Files, Program Files (x86), Downloaded Program Files, system, System32, some other existing folder, or a Utilities folder I create myself? What do you do?

    I actually have my own folder structure that I copy from machine to machine, so on my machines you’ll find it in c:usrbin. Basically I have a bunch of portable tools that I keep therein.

    Leo
    20-Nov-2011

Leave a reply:

Before commenting please:

  • Read the article. Seriously. You'd be shocked at how many people make comments that prove they didn't.
  • Comment only on the article. If you have a new, unrelated question start with the search box at the top of the page.
  • Don't post personal information. Email addresses, phone numbers and such will be removed.
  • Don't spam. Comments that look the least bit like spam will be removed.

Thanks!