Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm having a problem with windows constantly spinning up my secondary HDD. My main OS is on the C: partition of my SSD and on my HDD I have a D: partition for storage and an E: partition for recovery. Indexing is disabled for E: and D: and currently paused for all locations.

Setting the Windows power settings to turn off my HDD after 1 min of inactivity makes the drive spin down, but then wake up after around 20 s. When I set it to turn off after 2 min of inactivity it spins down very rarely, suggesting that there is something that is accessing the HDD at irregular intervals between 1:20 ~ 2:00 min. I have identified a peak in the resource manager that corresponds to the HDD activity.

This peak is high if the HDD did have time to spin down and then was woken up by the process causing the peak. The peak is tiny (but still there) if the HDD never had time to go to idle. Under the bar "Disk Activity", there is no image that has "D:" or "E:" in its path, so all I can do is to watch the peaks in the graphics to the right, not identify the cause in the list.

Using Sysinternals Process Monitor, I filter for any process that includes "D:" or "E:" in its path, and this made me able to identify and disable the QueryFullSizeInformationVolume via the registry key NoLowDiskSpaceChecks. However, this process did not correspond perfectly to my HDD wakes and disabling it did not help. As of now, Process Monitor reports that zero processes are accessing my HDD.

After reading another thread, I also tried disabling my page file (even though it's located on C:), just to see if this would make any difference, but it did not. I also tried to disable the controller for the HDD in the Device Manager, but this just made my drive remain spinning constantly. When I installed Win 7 a few months ago, my drive stayed quiet until I clicked it in Explorer, so I there is something that has changed within the last few months either with Windows or with some third party software. However, the same behavior is present when starting Windows with all non-Microsoft services disabled, suggesting that third party software probably isn't the culprit.

As of now I'm pretty lost and searching the web isn't helping me. I might try to boot another OS from a USB, but If anyone has any advice that can point me to a solution of my problem I would be very grateful.

share|improve this question
    
My solution to this problem: Windows 8.1 automatically created a page file on my HDD instead of placing one on the SSD. This had the consequence of spinning up that drive whenever the page file was accessed. Despite having 8 GB of RAM, whenever I would restore a program from being minimized, it would freeze the PC until that drive spun up. –  Josh Brown Nov 15 '13 at 14:13

2 Answers 2

Base

Process Explorer has a special column that tracks the change of the number of bytes read or written by a process:

enter image description here

enter image description here

enter image description here

You might be able to capture the name of the process that is reading or writing data to your secondary HDD this way.


//Edit:

If you know that it is the System process that writes something to the external hard drive, you could trace what the process is doing in the Process Monitor:

enter image description here

enter image description here


Start/stop the capture with Ctrl+E.

Define some of those filters:

enter image description here

enter image description here


//Edit2:

Maybe you could track the thread ID associated with a certain IRP event and then track the thread that caused that IRP event:

enter image description here

enter image description here

enter image description here

enter image description here

share|improve this answer
    
Thanks for the tip! Using DiskMon I saw that the length of the writes are 2 and the sector is 1465147856. However, using WinHex, nfi and Disk Explorer, I was unable to find which file was located at this sector (they couldn't findd it or it was located outside. With your tip I monitored the Delta Write Column in Process Explorer at the same time as the Resource Monitor and DiskMon. I have identified the process as "System". Great... Do you have any idea where to go from here? Is there any way I can find out exactly what the system process is doing? (Also, the size of the writes is 2 kb) –  cheflo Mar 5 '13 at 1:01
    
The PID for the system process is 4. –  cheflo Mar 5 '13 at 1:09
    
I got a bit further myself. By watching the timer on DiskMon, I am collecting all the activity from the process "system" at the same time stamp via Process Monitor (advanced output and profiling events enabled). However, I can't identify anything that is unique to the time stamps when there is activity on my 2ns HDD. There are process profiling event, IRP MJ WRITE, a page file on C (even though i turned that off) and FASTIO_RELASE_FOR_CC_FLUSH and several more FASTIO events. –  cheflo Mar 5 '13 at 1:54
    
Thanks for the update. I did this when I identified the IRP_MJ WRITE events. The only files that are being written at the corresponding timestamps from DiskMon are C:\pagefile.sys and C:\$LogFile. Using a WinHEx I was now able to determine that the sector that is written is part of what WinHEx labes as "unpartionable space" (yes, not unpartioned) on my secondary HDD. –  cheflo Mar 5 '13 at 2:44
    
Thanks for all the help! I solved it on a different route (see below), but I learnt a lot from your tips! –  cheflo Mar 5 '13 at 7:29
up vote 6 down vote accepted

SOLVED!

I stopped being fancy and decided to go in and disable all running services one by one until the computer crashed or my disk stayed idle. Luckily, I didn't need to go all the way to a crash and found the service "Sentinel LDK License Manager Service" to be responsible for the wake ups. I googled it and it seems to be related to Lightworks which I then uninstalled. The Sentinel Service did not uninstall with Lightworks, but somehow my HDD stays idle now that Lightworks is gone.

So, I guess the problem was somewhere there... Lightworks and the sentinel service did not get along and this caused my secondary HDD to wake up through writes in parts of it's "unpartionable" space... yeah that doesn't make much sense to me, but if someone googles this, you know what to do.

share|improve this answer
    
Good job. I wonder, why Process Explorer showed the read/write disk bytes change under the 'System' process, instead of under one of the svchost.exe processes. The process that runs system services is svchost.exe (there can be multiple of them, as you probably know). Would you care to install Lightworks again ;) and check, if, when you observe the second HDD spinning up, are there any reads/writes made by any of the svchost.exe processes in Process Explorer? I'm just curious. When you double click on a given svchost.exe in PE, the list of services handles by that process will show up. –  colemik Mar 5 '13 at 8:14
    
Hehe, I'm a little reluctant to install it again since it is all working fine now. But I might do it tonight since you were so helpful earlier =) –  cheflo Mar 5 '13 at 20:51
    
@trismarck: Since it is a software enforcing licensing it is probable that it uses some security through obscurity methods to hide how does it work. Maybe it is infiltrated into the OS kernel as a device driver, maybe it stores information directly on disk sectors out of files to hide it etc. –  pabouk Dec 19 '13 at 8:54
    
@pabouk: Interesting, thanks. –  colemik Dec 19 '13 at 10:31
    
I just put a new 4TB HDD in my computer and I couldn't figure out why the head was parking and unparking frequently. Your problem description is exactly the problem I was having. Drive access with nothing but the System process accessing the drive. Removed Lightworks and the mysterious drive access is gone. I hate to think how many load/unload cycles that has put on my other WD Green drives over the last year. The new one was cycling at least every 20 seconds. –  ChrisJD Mar 13 at 0:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.