Technology in terms you understand. Sign up for the Confident Computing newsletter for weekly solutions to make your life easier. Click here and get The Ask Leo! Guide to Staying Safe on the Internet — FREE Edition as my thank you for subscribing!

Why is My Disk Busy Even Though I’m Doing Nothing?

What to do if your hard disk is unexpectedly thrashing.

Hard Disk
(Image: canva.com)
Unexpected hard disk activity isn't unusual. I'll show you how to use a free monitoring tool to determine what program is causing it.
The Best of Ask Leo!
Why, when I’m doing nothing at all, will my hard disk suddenly start thrashing?

Thrashing — excessive disk activity — can happen for many reasons. The most common resource hogs are security tools, Windows Restore, or the system indexing service, if it’s enabled.

To find out what’s happening in your system, we’ll use a fairly powerful system monitoring tool called Procmon.

Become a Patron of Ask Leo! and go ad-free!

TL;DR:

Disk Busy?

Using a free Windows Sysinternals Suite tool called Process Monitor, you can examine exactly what programs are accessing your disk and what files they’re reading and writing. With that information in hand, you can decide if the program(s) are expected or if you need to take action.

Process Monitor

Process Monitor, or simply Procmon, is a free tool included in the Windows SysInternals Suite from Microsoft. (Don’t confuse it with Process Explorer, a different tool in the suite I often recommend as well.) It’s a very sophisticated system monitoring tool that works by:

  • Collecting data called “events”1 while your system runs, presumably while you’re experiencing whatever you’re attempting to understand.
  • Allowing you to examine the individual events.
  • Summarizing the event data in useful ways.

It’s that last feature we’ll focus on here.

Running Procmon

After installing the Sysinternals Suite, you’ll find Process Monitor in your “All apps” Start Menu.

SysInternals Tools on the Start Menu
Sysinternals Tools on the Start menu. Click for larger image. (Screenshot: askleo.com)

Since there are several Sysinternals tools, you’ll need to scroll down to locate Process Monitor.

Process Monitor on the Start Menu
Process Monitor on the Start menu. (Screenshot: askleo.com)

Click on it to run it.

You may be asked to confirm UAC. Click Yes. You may also be prompted with a “Process monitor filter” dialog saying you had filters on the last time you ran it. Ignore that for now; just click OK.

Process Monitor will start monitoring processes.

Monitoring processes

When you run Process Monitor, it’ll start recording things and displaying them in its windows. By default, it monitors a lot, and will probably surprise you with all the items scrolling by at a fast clip.

Process Monitor default results.
Process Monitor default results. Click for larger image. (Screenshot: askleo.com)

As long as the disk isn’t thrashing (it’s possible that it’s not even being hit at this point), it’s all quite normal. Let Process Monitor run.

As soon as you hear or see your hard disk thrashing when you think it shouldn’t be, let it run for a few more seconds and then press CTRL+E in Process Monitor to stop the capture.

If you like, you can scroll through the events to see what’s happening, but I have two better solutions.

Filter the results

Process Monitor has several ways to filter the results down to only the things you care about. One of the simplest is right on the toolbar.

Process Monitor Filter Buttons
Process Monitor filter buttons. (Screenshot: askleo.com)

Each button enables the display of a class of Process Monitor events. From left to right, they represent:

The one we care about for our purposes here is “File System activity” because we want to know what’s hitting the disk so hard. Since all five are selected by default, click on the other filter buttons until only File System activity remains selected.

Process Monitor showing only File System events.
Process Monitor showing only File System events. Click for larger image. (Screenshot: askleo.com)

The list of events is filtered to show only disk activity. You can scroll up and down this list to see what programs are accessing your disk(s), and what files they’re reading or writing to.

In the example above, it’s all about “MsMpEng.exe” (Microsoft Malware Protection Engine), which is a component of Windows Security. In other words, it’s probably just the security software scanning files on my hard disk.

Summarize the results

Click the Tools menu and then the File Summary… item. This gives you a report of the file I/O activity (input/output operations) within the recorded data.

Process Monitor File Report
Process Monitor File Report. Click for larger image. (Screenshot: askleo.com)

In the example above, I’ve made the window wider (by clicking and dragging its right edge), and made the “Path” column wider (by clicking and dragging its header’s right-hand divider).

The default is sorted by Total Events.  You can sort by any of the other column headers in the File Summary dialog, so you can see which file took the most time, had the most reads or writes, or any of several other activities. I assume that a simple “Why is my disk thrashing?” analysis, the default “Total Events” is the best place to start.

In the example above, sorting by “Read Bytes” shows that several “.dll” were responsible for most of the disk-read activity for the duration of the recorded events. If I sort by “Write Bytes”, we see that a Windows Defender file is being written to.

It’s important to note that this summary is a summary of all recorded events. If your disk thrashing represents only the last few seconds of a large amount of data, a summary might not show it as clearly.

Do this

Whether you look at the activity by time, by filtering the results, or by the files being accessed in the summary, you can gather clues as to what might be responsible for the disk activity you’re seeing.

The next question is: is it expected? Is it the result of the system operating as it should, or is it a sign of a problem?

You may recognize a process — perhaps your anti-malware tools, perhaps the system indexing service, perhaps something else you recognize — and be able to say, “Oh, it’s that,” and take no further action.

You might also decide that whatever is running is unwanted, and work through the steps to turn it off or remove it. Exactly what those steps are, of course, depend on exactly who the culprit turns out to be.

In the meantime, you also now have a new tool in your tool belt: Process Monitor. Feel free to explore some of the other filters and information it can gather for you about your system and how it operates.

Feel free to also subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.

Podcast audio

Play

Footnotes & References

1: Unrelated to the Event Viewer. These are different “events”.

17 comments on “Why is My Disk Busy Even Though I’m Doing Nothing?”

  1. A *new* common cause is Windows XP’s System Restore. It monitors changes to a wide range of files and squirrels away restore information. This often looks like unexpected disk activity as it does so.

    Reply
  2. PC very slow, upto 3 mins opening or closing progs prog seems to “wash” down the screen, icons disappear leaving only background pic for 5-10 secs, then reappear); hardisk access light almost continuously on, etc.(1)Resorted to original config. using System Restore, but initial improvement, then back to SLOW;(2)Configured WinXP for best performance, with virtual memory set at 754 MB (min) and 1024 MB (max) as per suggestions of HP customer support;(3) Virus checks (Norton, AVG) are clean;(4) SpybotS&D and Ad-Aware cleaned adware/spyware and now show clean;(5) Used a RegCleaner to clean the system without alteration;(6)installed and enabled firewall (successively by Norton, WinXP and ZoneAlarm Pro);(7) at HP customer support’s suggestion, closed all startup progs except antivirus and firewall, used Disk Cleaner & Defrag, then restarted the pc. Even uninstalled some progs I didn’t use frequently, all to no avail; (8)HD capacity shows drive C is 29% free (9.7 GB) and drive D 15% free at 6

    Reply
  3. Only 128mb of ram under WinXP is likely to be one of your problems. Your swap file is consuming it all. Buy at least 512mb of ram, preferably 1gb to run XP. You likely have an onboard video card which is consuming 32mb of your system’s ram which is why only 96mb appears under Windows. Does your motherboard have an AGP port? If so, I’d recommend buying a videocard for it. Check whether the motherboard supports AGP 1x / 2x / 4x / or 8x and buy a compatible video card.

    Your hard drive will thrash because you’ve told it to have 784mb minimum swap file. The access time to your hard drive is magnitudes slower than for your ram. Hence your system runs like a dog.

    Reply
  4. My Pc’s hard disk is still 85% full after all cleaning and removal of non-necessities. After defrag. there is not very much free space leftover either. I removed a bunch of media files and it seemed like I had less space after I erased them. How can I clean it up without compromising the programs and files that I have(which isn’t very many).Thanx for your help.

    Reply
  5. Hello Leo & Everyone

    My hard disk has started thrashing whenever Outlook 2003 has been running on idle for a few minutes. If I close Outlook 2003 the disk stops thrashing.

    I tried FileMon and captured the screen as soon as the thrashing started – it was full of the line “OUTLOOK.EXE:2144”

    The machine is running Windows 2000 Pro with Service Pack 4. It has 1.5Gb of RAM and the hard drive is a 123Gb IBM. Can anyone help me?

    Many thanks

    Simon.

    Reply
  6. Actually, try letting it “thrash” for a while. Outlook compacts its PST file in the background at idle time. At some point the file will have been compacted, and the thrashing should stop. (And technically it’s not thrashing … unless it somehow impacts your ability to do other things.) Conversely you could force compaction and see if that makes the thrashing stop as well.

    Reply
  7. Hello Leo,
    My laptop has been thrashing the HD, Also MS WORD won’t open and after it tries it leaves a rectangle of screen that does not repaint on the desktop also Norton Internet security 2006 does not open. I have phoned Symantec and run SYMNRT.exe and reinstalled Norton Internet security 2006 and reinstalled Norton Ghost 10 and reinstalled Word 2003 pro but I am right back at the starting point. Ctl Alt Del does not shut the computer down so I have to manually shut it down. The last time I restarted the laptop the screen was black so I manually shutdown again, after leaving the laptop shutdown for an hour I restarted it and it opened fine but the above problems are still there any help appreciated.
    My laptop specs are
    990 Megabytes Installed Memory, Slot ‘U5’ has 512 MB, Slot ‘U6’ has 512, Windows XP Professional Service Pack 2 (build 2600), 2.67 gigahertz Intel Pentium 4, 8 kilobyte primary memory, cache, 512 kilobyte secondary memory cache, 40.00 Gigabytes Usable Hard Drive Capacity, 26.93 Gigabytes Hard Drive Free Space, SiS M650 [Display adapter]Default Monitor,

    Reply
  8. I believe it is Norton Antivirus 2006 Autoupdate program that is stuck and is causing problems. Symantec who own the product won’t help find the answer without a 39.95 Euro charge and suggested I contact a local engineer to get my problem sorted. Any help appreciated…

    Reply
  9. If your machine is tweaked to perfection, and you have not disabled optimise hard drive on idle, and you have smallish clusters and or lots of data on your drives, defrag hangs.

    Norton 2006, Outlook cleanup, Outlook Express Cleanup, Scheduled Disk Doctor defragmenting, Viruses and Spyware also do create the same disk slow scenario.

    Personally, I disable deframgenting when idle, format my drives with 64K clusters (lose a bit of space but pickup loads of disk speed), and defrag via bat file on startup.

    It’s a good idea to disable system restore on non essential drives. I actually don’t use it, as my OS is installed on a partition, and Documents and Settings and data files are on another, that is backed up. On system failure, I reinstall the OS and programs, do some registry tweaks, and point my data files to certain folders, and I’m back in business.

    I’ve had so many problems with Windows on our network the past month. Viruses have been on the increase. I’m moving some machines over to Linux and running Windows in a virtual machine for certain applications. I will still however need a single Windows dedicated machine for certain software.

    Reply
  10. To stop thrashing hard drive in Windows XP, alter the setting of memory from the default (adjust for best performance of programs) to ‘adjust for best performance of system cache’. There are no bad side effects.

    Reply
  11. I ran process monitor on my wife’s computer because its HD keeps running even though I have shut off indexing and defrag. It has hundreds of entries where snippit is opened and closed. She doesn’t even know what snippit is. I do use it on my computer and have months ago on hers. Is it likely that there is some sort of key logging or similar spy process going on?

    Reply
  12. I had a similar problem. My hard drive would thrash constantly on a pretty fast Core i7 compy with 12Gig RAM. It was infuriating. I searched the intertubes and came across this thread. I tried what was suggested, but it didn’t fix my problem. I did fix my problem though.

    It turns out my outlook.ost file was too big. I found out from Microsoft that you may experience issues with .ost files over 2Gig. Well, mine was over 19Gig!

    I closed down Outlook. Then I just renamed the file outlook_bak20091216.ost. I then launched Outlook and it rebuilt the outlook.ost file from the Exchange server. My new outlook.ost file is under 1Gig. Better yet, no more hard drive thrashing.

    Reply
  13. My harddrive will start thrashing, and the screen goes blank. I can hear the processor cooling fan kick into high speed. This doesnt happen very often but it will do it at an idle or when im working. I am running xp with sp3. I do have spyware/virus programs. I am cut off from accessing the computer when this happens so I have no idea what is causing it or what happens as I have to pull the plug to stop it. I let it run for 10 mins one time to see if it would stop.
    Any ideas where I should start? Will “filemon” record all activity even if I pull the plug?

    Reply
  14. Aside from doing the routine maintenance items; i.e. disk defrag, registry cleaning, deleting temp files, I recommend doing the this. Uninstall your Anti-virus program and reboot. If this doesn’t give you back a new computer high performance I would be shocked. Sure, it could be your hard drive going but what do you think causes most hard drive failures, misuse – drive thrashing, multiple PC restarts (power bumps) viruses and poor hard drive maintenance.

    If you are using McAfee or Norton, especially the ones custom tailored for Verizon and Comcast like I was using you should gain back a stable PC if you uninstall them. I replaced Norton with Avira and I no longer have PC issues.

    Reply
  15. Leo,

    I’ve downloaded the zip files for both Process Monitor and Process Explorer to my Downloads folder. After extracting, the exe files run from there just fine. This is nice for portability, as I can stick them on a USB drive and troubleshoot other PCs.

    For my own PC (Win7 Home), I’d like to give them a more permanent home, and wonder what would be most logical. Program Files, Program Files (x86), Downloaded Program Files, system, System32, some other existing folder, or a Utilities folder I create myself? What do you do?

    I actually have my own folder structure that I copy from machine to machine, so on my machines you’ll find it in c:usrbin. Basically I have a bunch of portable tools that I keep therein.

    Leo
    20-Nov-2011

    Reply

Leave a reply:

Before commenting please:

  • Read the article.
  • Comment on the article.
  • No personal information.
  • No spam.

Comments violating those rules will be removed. Comments that don't add value will be removed, including off-topic or content-free comments, or comments that look even a little bit like spam. All comments containing links and certain keywords will be moderated before publication.

I want comments to be valuable for everyone, including those who come later and take the time to read.