Technology in terms you understand. Sign up for the Confident Computing newsletter for weekly solutions to make your life easier. Click here and get The Ask Leo! Guide to Staying Safe on the Internet — FREE Edition as my thank you for subscribing!

Why, when I’m doing nothing at all, will my hard disk suddenly start thrashing?

Why, when I’m doing nothing at all, will my hard disk suddenly start thrashing?

It could be for many reasons. The most common are antivirus tools or the system indexing service, if it’s enabled.

To find out what’s happening on your system, we’ll use fairly powerful system monitoring tool called Procmon.

Become a Patron of Ask Leo! and go ad-free!

Process Monitor

Process Monitor, or simply Procmon, is a free tool that you can download here from Microsoft. (It’s different from, and should not be confused with, Process Explorer.) It’s a very sophisticated system monitoring tool that works by:

  • Collecting data, called “events”, while your system runs – presumably while you’re experiencing whatever it is that you’re attempting to understand.
  • Allowing you to examine the individual events.
  • Summarizing the event data in useful ways.

It’s that last feature that we’ll focus on here.

Running Procmon

When you run Procmon, you’ll probably be surprised by all the things your system is doing while you’re not doing anything.

Process Monitor Initial Screen

As long as the disk isn’t thrashing (it’s possible that it’s not even being hit at this point), it’s all quite normal. Let Procmon run.

As soon as you hear your hard disk thrashing when you think it shouldn’t be, let it run for a few seconds and then press CTRL+E in Procmon to stop the capture.

In among all of the other events are some relating to disk I/O. If you like, you can scroll through the events to see what’s happening, but I have a better solution.

File summary…

Click the Tools menu and then the File Summary… item. This gives you a report of the file I/O activity within the recorded data:

Process Monitor file summary

The default is sorted by Total Events. Scroll the data to the left to see the rightmost Path column (which you can also widen by grabbing its right-most column header bar and dragging right).

Process Monitor file summary showing Path

You can also sort by any of the other column headers in the File Summary dialog so you can see which file took the most time, had the most reads, writes, or any of several other activities. I would assume that for simple “Why is my disk thrashing?” analysis, the default “Total Events” is likely to be the best place to start.

Expected or not?

What we may determine is that the results that you find are indeed expected behavior for your system. You may recognize a process – perhaps your anti-malware tools, perhaps the system indexing service, perhaps something else that you recognize – and simply be able to say, “Oh, it’s that,” and take no further action.

On the other hand, you might also decide that whatever is running is unwanted and work through the steps to turn it off or remove it. Exactly what those steps are, of course, will depend on exactly who the culprit turns out to be.

(This is an update to an article originally published August 10, 2003.)

Do this

Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.

I'll see you there!

18 comments on “Why, when I’m doing nothing at all, will my hard disk suddenly start thrashing?”

  1. A *new* common cause is Windows XP’s System Restore. It monitors changes to a wide range of files and squirrels away restore information. This often looks like unexpected disk activity as it does so.

  2. PC very slow, upto 3 mins opening or closing progs prog seems to “wash” down the screen, icons disappear leaving only background pic for 5-10 secs, then reappear); hardisk access light almost continuously on, etc.(1)Resorted to original config. using System Restore, but initial improvement, then back to SLOW;(2)Configured WinXP for best performance, with virtual memory set at 754 MB (min) and 1024 MB (max) as per suggestions of HP customer support;(3) Virus checks (Norton, AVG) are clean;(4) SpybotS&D and Ad-Aware cleaned adware/spyware and now show clean;(5) Used a RegCleaner to clean the system without alteration;(6)installed and enabled firewall (successively by Norton, WinXP and ZoneAlarm Pro);(7) at HP customer support’s suggestion, closed all startup progs except antivirus and firewall, used Disk Cleaner & Defrag, then restarted the pc. Even uninstalled some progs I didn’t use frequently, all to no avail; (8)HD capacity shows drive C is 29% free (9.7 GB) and drive D 15% free at 6

  3. Only 128mb of ram under WinXP is likely to be one of your problems. Your swap file is consuming it all. Buy at least 512mb of ram, preferably 1gb to run XP. You likely have an onboard video card which is consuming 32mb of your system’s ram which is why only 96mb appears under Windows. Does your motherboard have an AGP port? If so, I’d recommend buying a videocard for it. Check whether the motherboard supports AGP 1x / 2x / 4x / or 8x and buy a compatible video card.

    Your hard drive will thrash because you’ve told it to have 784mb minimum swap file. The access time to your hard drive is magnitudes slower than for your ram. Hence your system runs like a dog.

  4. My Pc’s hard disk is still 85% full after all cleaning and removal of non-necessities. After defrag. there is not very much free space leftover either. I removed a bunch of media files and it seemed like I had less space after I erased them. How can I clean it up without compromising the programs and files that I have(which isn’t very many).Thanx for your help.

  5. Hello Leo & Everyone

    My hard disk has started thrashing whenever Outlook 2003 has been running on idle for a few minutes. If I close Outlook 2003 the disk stops thrashing.

    I tried FileMon and captured the screen as soon as the thrashing started – it was full of the line “OUTLOOK.EXE:2144”

    The machine is running Windows 2000 Pro with Service Pack 4. It has 1.5Gb of RAM and the hard drive is a 123Gb IBM. Can anyone help me?

    Many thanks


  6. Actually, try letting it “thrash” for a while. Outlook compacts its PST file in the background at idle time. At some point the file will have been compacted, and the thrashing should stop. (And technically it’s not thrashing … unless it somehow impacts your ability to do other things.) Conversely you could force compaction and see if that makes the thrashing stop as well.

  7. Hello Leo,
    My laptop has been thrashing the HD, Also MS WORD won’t open and after it tries it leaves a rectangle of screen that does not repaint on the desktop also Norton Internet security 2006 does not open. I have phoned Symantec and run SYMNRT.exe and reinstalled Norton Internet security 2006 and reinstalled Norton Ghost 10 and reinstalled Word 2003 pro but I am right back at the starting point. Ctl Alt Del does not shut the computer down so I have to manually shut it down. The last time I restarted the laptop the screen was black so I manually shutdown again, after leaving the laptop shutdown for an hour I restarted it and it opened fine but the above problems are still there any help appreciated.
    My laptop specs are
    990 Megabytes Installed Memory, Slot ‘U5’ has 512 MB, Slot ‘U6’ has 512, Windows XP Professional Service Pack 2 (build 2600), 2.67 gigahertz Intel Pentium 4, 8 kilobyte primary memory, cache, 512 kilobyte secondary memory cache, 40.00 Gigabytes Usable Hard Drive Capacity, 26.93 Gigabytes Hard Drive Free Space, SiS M650 [Display adapter]Default Monitor,

  8. I believe it is Norton Antivirus 2006 Autoupdate program that is stuck and is causing problems. Symantec who own the product won’t help find the answer without a 39.95 Euro charge and suggested I contact a local engineer to get my problem sorted. Any help appreciated…

  9. If your machine is tweaked to perfection, and you have not disabled optimise hard drive on idle, and you have smallish clusters and or lots of data on your drives, defrag hangs.

    Norton 2006, Outlook cleanup, Outlook Express Cleanup, Scheduled Disk Doctor defragmenting, Viruses and Spyware also do create the same disk slow scenario.

    Personally, I disable deframgenting when idle, format my drives with 64K clusters (lose a bit of space but pickup loads of disk speed), and defrag via bat file on startup.

    It’s a good idea to disable system restore on non essential drives. I actually don’t use it, as my OS is installed on a partition, and Documents and Settings and data files are on another, that is backed up. On system failure, I reinstall the OS and programs, do some registry tweaks, and point my data files to certain folders, and I’m back in business.

    I’ve had so many problems with Windows on our network the past month. Viruses have been on the increase. I’m moving some machines over to Linux and running Windows in a virtual machine for certain applications. I will still however need a single Windows dedicated machine for certain software.

  10. All the above suggestions are ‘over my head’ so, I guess I will have to listen to the growling that is called thrashing by the literate above. I, too, wonder if this is taking up disk space which seems to be decreasing as time goes by and I do not add downloads or new programs. Defrag.,scanned often.

  11. To stop thrashing hard drive in Windows XP, alter the setting of memory from the default (adjust for best performance of programs) to ‘adjust for best performance of system cache’. There are no bad side effects.

  12. I ran process monitor on my wife’s computer because its HD keeps running even though I have shut off indexing and defrag. It has hundreds of entries where snippit is opened and closed. She doesn’t even know what snippit is. I do use it on my computer and have months ago on hers. Is it likely that there is some sort of key logging or similar spy process going on?

  13. I had a similar problem. My hard drive would thrash constantly on a pretty fast Core i7 compy with 12Gig RAM. It was infuriating. I searched the intertubes and came across this thread. I tried what was suggested, but it didn’t fix my problem. I did fix my problem though.

    It turns out my outlook.ost file was too big. I found out from Microsoft that you may experience issues with .ost files over 2Gig. Well, mine was over 19Gig!

    I closed down Outlook. Then I just renamed the file outlook_bak20091216.ost. I then launched Outlook and it rebuilt the outlook.ost file from the Exchange server. My new outlook.ost file is under 1Gig. Better yet, no more hard drive thrashing.

  14. My harddrive will start thrashing, and the screen goes blank. I can hear the processor cooling fan kick into high speed. This doesnt happen very often but it will do it at an idle or when im working. I am running xp with sp3. I do have spyware/virus programs. I am cut off from accessing the computer when this happens so I have no idea what is causing it or what happens as I have to pull the plug to stop it. I let it run for 10 mins one time to see if it would stop.
    Any ideas where I should start? Will “filemon” record all activity even if I pull the plug?

  15. Aside from doing the routine maintenance items; i.e. disk defrag, registry cleaning, deleting temp files, I recommend doing the this. Uninstall your Anti-virus program and reboot. If this doesn’t give you back a new computer high performance I would be shocked. Sure, it could be your hard drive going but what do you think causes most hard drive failures, misuse – drive thrashing, multiple PC restarts (power bumps) viruses and poor hard drive maintenance.

    If you are using McAfee or Norton, especially the ones custom tailored for Verizon and Comcast like I was using you should gain back a stable PC if you uninstall them. I replaced Norton with Avira and I no longer have PC issues.

  16. Leo,

    I’ve downloaded the zip files for both Process Monitor and Process Explorer to my Downloads folder. After extracting, the exe files run from there just fine. This is nice for portability, as I can stick them on a USB drive and troubleshoot other PCs.

    For my own PC (Win7 Home), I’d like to give them a more permanent home, and wonder what would be most logical. Program Files, Program Files (x86), Downloaded Program Files, system, System32, some other existing folder, or a Utilities folder I create myself? What do you do?

    I actually have my own folder structure that I copy from machine to machine, so on my machines you’ll find it in c:usrbin. Basically I have a bunch of portable tools that I keep therein.



Leave a reply:

Before commenting please:

  • Read the article.
  • Comment on the article.
  • No personal information.
  • No spam.

Comments violating those rules will be removed. Comments that don't add value will be removed, including off-topic or content-free comments, or comments that look even a little bit like spam. All comments containing links and certain keywords will be moderated before publication.

I want comments to be valuable for everyone, including those who come later and take the time to read.