Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a LaCie USB disk that when attached to my MacBook Pro does not stop reading or writing. It makes noise all the time, even when I don't do anything with it. The drive won't eject normally (i.e. eject and spin down), instead I have to force eject it and the drive is still running afterwards.

If I connect the drive to my Windows 7 PC, it runs absolutely fine.

I've seen this behavior for a few weeks now and can't recall if I installed anything that could be the cause of the problem. The drive is using FAT32.

Does anybody know a way to find out which program is making the drive do all those read or write operations?

share|improve this question
You could try adding it to the Spotlight blacklist in System Preferences, (Personal, ) Spotlight, Privacy. – Daniel Beck Nov 30 '10 at 10:46
How is the disk formatted (file system)? – Daniel Beck Nov 30 '10 at 11:03
It's FAT32. @Daniel, I will try that later! Although I have never had issues with Spotlight. – slhck Nov 30 '10 at 13:01
up vote 5 down vote accepted

There are several command-line tools that can help with tracking this sort of thing down. To find out what's causing activity on the disk, I'd use fs_usage. Here's an example of using it to watch my spare volume while I create a file from bash:

$ sudo fs_usage | grep /Volumes/Spare
Password: [enter admin password; it will not echo]
08:56:10  open              /Volumes/Spare/somefile                                                          0.000827   bash        
08:56:10  lstat64           /Volumes/Spare                                                                   0.000029   fseventsd   
08:56:10  getattrlist       /Volumes/Spare                                                                   0.000017   Finder      
08:56:10  getattrlist       /Volumes/Spare                                                                   0.000030   Finder      
08:56:10  getattrlist       /Volumes/Spare                                                                   0.000013   Finder      
08:56:10  access_extended   /Volumes/Spare                                                                   0.000045   Finder      
08:56:10  lstat64           /Volumes/Spare/somefile                                                          0.000038   mdworker    
08:56:10  getattrlist       /Volumes/Spare/somefile                                                          0.000023   mdworker    
08:56:10  getattrlist       /Volumes/Spare/somefile                                                          0.000034   mdworker    
08:56:10  open              /Volumes/Spare/somefile                                                          0.000027   mdworker    
08:56:10  getattrlist       /Volumes/Spare/somefile                                                          0.000018   mdworker    
08:56:10  open              /Volumes/Spare/somefile                                                          0.000016   mdworker    
08:56:10  getattrlist       /Volumes/Spare/somefile                                                          0.000017   mdworker    
08:56:10  getattrlist       /Volumes/Spare/somefile                                                          0.000012   mdworker

(Notes: when fs_usage is piped to another command, it formats its output for 132-column display -- to make it readable, you should widen your Terminal window to match. Also, use control-C to exit). The interesting columns here are the third (file path) and last (process name) -- in this example, bash created /Volumes/Spare/somefile, Finder noticed that something had changed and checked the folder's attributes, and mdworker (part of Spotlight) noticed the new file and examined it to add to the volume's search index.

Another useful tool for this sort of thing is lsof (list open files):

$ sudo lsof | grep /Volumes/Spare
mds          30           root  txt       REG       14,4          2      430 /Volumes/Spare/.Spotlight-V100/Store-V1/Stores/0DF7E0C0-E376-45EF-81DC-0F0C64676526/0.indexGroups
mds          30           root  txt       REG       14,4       2056      435 /Volumes/Spare/.Spotlight-V100/Store-V1/Stores/0DF7E0C0-E376-45EF-81DC-0F0C64676526/0.indexDirectory
mds          30           root  txt       REG       14,4          8      436 /Volumes/Spare/.Spotlight-V100/Store-V1/Stores/0DF7E0C0-E376-45EF-81DC-0F0C64676526/0.indexCompactDirectory
mds          30           root  txt       REG       14,4       2731      400 /Volumes/Spare/.Spotlight-V100/Store-V1/Stores/0DF7E0C0-E376-45EF-81DC-0F0C64676526/live.0.indexGroups
mds          30           root  txt       REG       14,4       1024      406 /Volumes/Spare/.Spotlight-V100/Store-V1/Stores/0DF7E0C0-E376-45EF-81DC-0F0C64676526/live.0.indexCompactDirectory

Here the process name is in the first column, and the file path is at the end (and the display is even wider). In this example, all that's there is mds (another part of Spotlight) sitting there with its index database open.

While fs_usage is good for looking at activity over time (but won't show files that are open but inactive), lsof gives a snapshot of which programs are using which files (but won't show how active they are, and will miss files that're opened, used, then immediately closed). Together, these tools give a fairly good picture of what's going on.

share|improve this answer
Thank you very much! I could track down the demo version of TotalFinder I recently installed - removed it, now everything runs fine again. – slhck Nov 30 '10 at 22:11

Try using Activity Normally found in :


Have it monitor All Processes, then sort on %CPU. If something is constantly reading/writing to disk, it is likely it will be seen with this utility.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.