Question How to identify what program is accessing a disk?

[nickbeef]

I am trying to transfer large amounts of data across hard drives - like terabytes of data, so it takes most of a day to transfer. I use TeraCopy for the transfer, so I can see exactly the rate at which the date is transferring. I sometimes see that the date rate has throttled down, so I just paused the transfer and now I'm seeing that something is continuing to access my hard drive, but I can't identify what?

Now, I have 9 different hard drives installed. And currently most of them are totally idle at 0%. I have an archive RAID (M: ), which is the source of the data, and moving it to a drive dedicated to active projects that I'm working on (F: ), which is the target drive. However, in order to detect the source of the throttle, I have paused the transfer and still see that my F: drive went from 100% usage, down to 40% (give or take), which means something is still accessing this drive. I don't run any other programs, etc. off this drive.

Here's what I've tried: Task Manager>Processes can tell me what program is accessing the most of any drive, but doesn't tell me which drive it is, so not useful when I have 9 different drives. Task Manager>Performance breaks down how much of each disk is being used (very useful), but doesn't seem to tell me which program is accessing it. This is how I know "something" is using 40% of F:, but not what that "something" is. Lastly in Resource Monitor>Disk I can sort by File (thankfully it's by file path), and I get a list of files that are currently showing Disk Activity, but unfortunately nothing is showing up as running on the F: drive, even though the graph on the right hand site is showing F: running at 40%!

Suggestions?

 

[TerryLaze]

You are moving from a raid to a normal disk which means that the target drive is much slower so anytime the cache fills up the copy process has to wait for the cache to be emptied to the destination disk.

 

[kanewolf]

I am trying to transfer large amounts of data across hard drives - like terabytes of data, so it takes most of a day to transfer. I use TeraCopy for the transfer, so I can see exactly the rate at which the date is transferring. I sometimes see that the date rate has throttled down, so I just paused the transfer and now I'm seeing that something is continuing to access my hard drive, but I can't identify what?

Now, I have 9 different hard drives installed. And currently most of them are totally idle at 0%. I have an archive RAID (M, which is the source of the data, and moving it to a drive dedicated to active projects that I'm working on (F, which is the target drive. However, in order to detect the source of the throttle, I have paused the transfer and still see that my F: drive went from 100% usage, down to 40% (give or take), which means something is still accessing this drive. I don't run any other programs, etc. off this drive.

Here's what I've tried: Task Manager>Processes can tell me what program is accessing the most of any drive, but doesn't tell me which drive it is, so not useful when I have 9 different drives. Task Manager>Performance breaks down how much of each disk is being used (very useful), but doesn't seem to tell me which program is accessing it. This is how I know "something" is using 40% of F:, but not what that "something" is. Lastly in Resource Monitor>Disk I can sort by File (thankfully it's by file path), and I get a list of files that are currently showing Disk Activity, but unfortunately nothing is showing up as running on the F: drive, even though the graph on the right hand site is showing F: running at 40%!

Suggestions?

Indexing would be one obvious source of disk access. Antivirus scanning could be another.

 

[nickbeef]

You are moving from a raid to a normal disk which means that the target drive is much slower so anytime the cache fills up the copy process has to wait for the cache to be emptied to the destination disk.

Well, since you don't know what kind of RAID I have set up, I'm not sure you can accurately say this. In fact, the RAID I have is a Drobo so it's set to some kind of mirroring of the disks - not set to split data across disks for speed. Now, maybe you understand this in a way I don't, but my understanding is that this would make the RAID slower, not faster, then the destination drive. Destination drive is a WD Black.

 

[USAFRet]

Well, since you don't know what kind of RAID I have set up, I'm not sure you can accurately say this. In fact, the RAID I have is a Drobo so it's set to some kind of mirroring of the disks - not set to split data across disks for speed. Now, maybe you understand this in a way I don't, but my understanding is that this would make the RAID slower, not faster, then the destination drive. Destination drive is a WD Black.

Drobo has its own proprietary subsystem and way of working.
It is NOT like a normal RAID.

A mirror in a Drobo may be slower, the same, or 'faster'.

And the target drive may simply be caching the data, until there is free time to write to the actual platters.

 

[nickbeef]

Indexing would be one obvious source of disk access. Antivirus scanning could be another.

Sure, but is there a way to identify what exactly is accessing the disk so I could potentially stop it?

UPDATE: I was able to identify the issue, but only because the program that was accessing the drive stopped and then the throttling was gone. I have Acronis True Image set to automatically backup some of my folders and drives, and seems to have started a backup when during my transfer. Cool. Not a problem. But my original question remains - how could I have identified that this program was the culprit, so that I could have stopped or paused its operation in order to prioritize my transfer?

 

[USAFRet]

But my original question remains - how could I have identified that this program was the culprit, so that I could have stopped or paused its operation in order to prioritize my transfer?

Task Manager, at the moment it is happening. Sort on 'Disk'.
Or Resource Monitor for a more indepth look.

 

[Math Geek]

for future reference, process explorer is a pretty good way to see what is doing what. it is like task manager but much more involved.

https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer

task manager and resource monitor also provide some of this information.

 

[nickbeef]

for future reference, process explorer is a pretty good way to see what is doing what. it is like task manager but much more involved.

https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer

task manager and resource monitor also provide some of this information.

Process Explorer looks cool, but I still can't seem to find out what program is accessing which drive?

 

[Deleted member 14196]

Use diskmon from Susinternals

https://docs.microsoft.com/en-us/sysinternals/downloads/diskmon

 

[TerryLaze]

Process Explorer looks cool, but I still can't seem to find out what program is accessing which drive?

It wasn't acronis after all?
If it's the caching it's probable to not show up in any tool since it's a system thing.
In process explorer got to view->select columns, go to process I/O and select reads and writes, then sort the list by writes.
It doesn't hurt if you start the program in admin mode either.

You can try file->show details for all processes to get info on some more system processes as well.

 

[Deleted member 14196]

ALL disk access is shown in Diskmon. No matter what. Use it like I said. You can turn on recording and then just search your text file for what you’re looking for

 

[nickbeef]

It wasn't acronis after all?
If it's the caching it's probable to not show up in any tool since it's a system thing.
In process explorer got to view->select columns, go to process I/O and select reads and writes, then sort the list by writes.
It doesn't hurt if you start the program in admin mode either.

You can try file->show details for all processes to get info on some more system processes as well.

Sorry, it was Acronis. But this would be useful information to be able to identify in the future. The only reason I was able to identify Acronis is because I saw that it was running, and was almost done. So I just watched the drive usage as it ended the backup, and boom, usage dropped to 0%.

Obviously I can't do that every time something mysteriously is access a drive.

 

[Math Geek]

as noted above, change the columns to add i/o read and write. this adds disk access to task manager or process explorer. shows exactly what is using the disk and how much. it would have shown you that it was using the disk at the time.

 

[nickbeef]

as noted above, change the columns to add i/o read and write. this adds disk access to task manager or process explorer. shows exactly what is using the disk and how much. it would have shown you that it was using the disk at the time.

Maybe I'm missing something, but I had already added "I/O Reads" and "I/O Writes" (also "I/O Read Bytes" and "I/O Write Bytes") in Process Explorer, hoping that this would help... but I don't see how it does. It tells me that "X" program is writing "Y" data..... but it does not tell me WHERE.

Again, I have at least 9 active hard drives installed. Most of these processes that I see in either Task Manager or Process Explorer are going to running on my C: drive, because it's my boot drive. But when I see that SOMETHING (I don't know what) is accessing, let's say, my F: drive, I want to find out what that SOMETHING is. Total I/O reads and writes don't tell me that.

 

[nickbeef]

Tried Disk Monitor as well..... yet again only partial information that doesn't seem to help. It's crazy real time data telling me that data is being written to "X" drive. Cool. But what program is doing it? Doesn't seem to say.

So I can either get a program to tell me "here's all programs and how much data they are writing" or "here's how much data is being written to each particular drive" but not "here's all programs and what drives they are writing to"..... this last one is the question I need answering.

In fact, I can barely see why I would care to know "how much data is being written to each drive" with out knowing what is doing the writing?