29

I'm having a problem with windows constantly spinning up my secondary HDD. My main OS is on the C: partition of my SSD and on my HDD I have a D: partition for storage and an E: partition for recovery. Indexing is disabled for E: and D: and currently paused for all locations.

Setting the Windows power settings to turn off my HDD after 1 min of inactivity makes the drive spin down, but then wake up after around 20 s. When I set it to turn off after 2 min of inactivity it spins down very rarely, suggesting that there is something that is accessing the HDD at irregular intervals between 1:20 ~ 2:00 min. I have identified a peak in the resource manager that corresponds to the HDD activity.

This peak is high if the HDD did have time to spin down and then was woken up by the process causing the peak. The peak is tiny (but still there) if the HDD never had time to go to idle. Under the bar "Disk Activity", there is no image that has "D:" or "E:" in its path, so all I can do is to watch the peaks in the graphics to the right, not identify the cause in the list.

Using Sysinternals Process Monitor, I filter for any process that includes "D:" or "E:" in its path, and this made me able to identify and disable the QueryFullSizeInformationVolume via the registry key NoLowDiskSpaceChecks. However, this process did not correspond perfectly to my HDD wakes and disabling it did not help. As of now, Process Monitor reports that zero processes are accessing my HDD.

After reading another thread, I also tried disabling my page file (even though it's located on C:), just to see if this would make any difference, but it did not. I also tried to disable the controller for the HDD in the Device Manager, but this just made my drive remain spinning constantly. When I installed Win 7 a few months ago, my drive stayed quiet until I clicked it in Explorer, so I there is something that has changed within the last few months either with Windows or with some third party software. However, the same behavior is present when starting Windows with all non-Microsoft services disabled, suggesting that third party software probably isn't the culprit.

As of now I'm pretty lost and searching the web isn't helping me. I might try to boot another OS from a USB, but If anyone has any advice that can point me to a solution of my problem I would be very grateful.

Improve this question
2
  • My solution to this problem: Windows 8.1 automatically created a page file on my HDD instead of placing one on the SSD. This had the consequence of spinning up that drive whenever the page file was accessed. Despite having 8 GB of RAM, whenever I would restore a program from being minimized, it would freeze the PC until that drive spun up.
    – Josh Brown
    Nov 15, 2013 at 14:13
  • DISABLE indexing in the drives that keep spinning up! online-tech-tips.com/computer-tips/…
    – marcolopes
    May 30, 2021 at 6:06

4 Answers 4

Reset to default
19

Base

Process Explorer has a special column that tracks the change of the number of bytes read or written by a process:

enter image description here

enter image description here

enter image description here

You might be able to capture the name of the process that is reading or writing data to your secondary HDD this way.

//Edit:

If you know that it is the System process that writes something to the external hard drive, you could trace what the process is doing in the Process Monitor:

enter image description here

enter image description here

Start/stop the capture with Ctrl+E.

Define some of those filters:

enter image description here

enter image description here

//Edit2:

Maybe you could track the thread ID associated with a certain IRP event and then track the thread that caused that IRP event:

enter image description here

enter image description here

enter image description here

enter image description here

Improve this answer
6
  • 1
    Thanks for the tip! Using DiskMon I saw that the length of the writes are 2 and the sector is 1465147856. However, using WinHex, nfi and Disk Explorer, I was unable to find which file was located at this sector (they couldn't findd it or it was located outside. With your tip I monitored the Delta Write Column in Process Explorer at the same time as the Resource Monitor and DiskMon. I have identified the process as "System". Great... Do you have any idea where to go from here? Is there any way I can find out exactly what the system process is doing? (Also, the size of the writes is 2 kb)
    – joelostblom
    Mar 5, 2013 at 1:01
  • The PID for the system process is 4.
    – joelostblom
    Mar 5, 2013 at 1:09
  • I got a bit further myself. By watching the timer on DiskMon, I am collecting all the activity from the process "system" at the same time stamp via Process Monitor (advanced output and profiling events enabled). However, I can't identify anything that is unique to the time stamps when there is activity on my 2ns HDD. There are process profiling event, IRP MJ WRITE, a page file on C (even though i turned that off) and FASTIO_RELASE_FOR_CC_FLUSH and several more FASTIO events.
    – joelostblom
    Mar 5, 2013 at 1:54
  • Thanks for the update. I did this when I identified the IRP_MJ WRITE events. The only files that are being written at the corresponding timestamps from DiskMon are C:\pagefile.sys and C:\$LogFile. Using a WinHEx I was now able to determine that the sector that is written is part of what WinHEx labes as "unpartionable space" (yes, not unpartioned) on my secondary HDD.
    – joelostblom
    Mar 5, 2013 at 2:44
  • Thanks for all the help! I solved it on a different route (see below), but I learnt a lot from your tips!
    – joelostblom
    Mar 5, 2013 at 7:29
7

SOLVED!

I stopped being fancy and decided to go in and disable all running services one by one until the computer crashed or my disk stayed idle. Luckily, I didn't need to go all the way to a crash and found the service "Sentinel LDK License Manager Service" to be responsible for the wake ups. I googled it and it seems to be related to Lightworks which I then uninstalled. The Sentinel Service did not uninstall with Lightworks, but somehow my HDD stays idle now that Lightworks is gone.

So, I guess the problem was somewhere there... Lightworks and the sentinel service did not get along and this caused my secondary HDD to wake up through writes in parts of it's "unpartionable" space... yeah that doesn't make much sense to me, but if someone googles this, you know what to do.

Improve this answer
6
  • Good job. I wonder, why Process Explorer showed the read/write disk bytes change under the 'System' process, instead of under one of the svchost.exe processes. The process that runs system services is svchost.exe (there can be multiple of them, as you probably know). Would you care to install Lightworks again ;) and check, if, when you observe the second HDD spinning up, are there any reads/writes made by any of the svchost.exe processes in Process Explorer? I'm just curious. When you double click on a given svchost.exe in PE, the list of services handles by that process will show up.
    – colemik
    Mar 5, 2013 at 8:14
  • Hehe, I'm a little reluctant to install it again since it is all working fine now. But I might do it tonight since you were so helpful earlier =)
    – joelostblom
    Mar 5, 2013 at 20:51
  • 1
    @trismarck: Since it is a software enforcing licensing it is probable that it uses some security through obscurity methods to hide how does it work. Maybe it is infiltrated into the OS kernel as a device driver, maybe it stores information directly on disk sectors out of files to hide it etc.
    – pabouk - Ukraine stay strong
    Dec 19, 2013 at 8:54
  • I just put a new 4TB HDD in my computer and I couldn't figure out why the head was parking and unparking frequently. Your problem description is exactly the problem I was having. Drive access with nothing but the System process accessing the drive. Removed Lightworks and the mysterious drive access is gone. I hate to think how many load/unload cycles that has put on my other WD Green drives over the last year. The new one was cycling at least every 20 seconds.
    – ChrisJD
    Mar 13, 2014 at 0:28
  • @ChrisJD Great! Do you by any chance remember which version of Lightworks you were using? I reported this problem in the Lightworks forum lwks.com/…, but they said that Lightworks is no longer using the Sentinel LDK License Manager Service, which I thought was the culprit to the wakeups.
    – joelostblom
    Mar 13, 2014 at 20:52
2

For all the lost souls out there, my Windows 10 pro 64bit 20H2 was spinning the D:\ drive every so often, so I fired the (win+R) resmon.exe, clicked the header FILE in the list on middle pane of the Disk tab to see the files alphabetically from last to first. Then D:\ files will then appear as first as soon as they get accessed. Then I just waited for spin-down and spin-up and observed the system while normally working with it.

When it happened a few times, I have realized in a flash of genius that the files accessed ocassionally on D:\ were exactly those apps which had shortcuts on the desktop. This did not happen randomly and it was always system.exe or explorer.exe which accessed them. So I just created a directory on the desktop and put the shortcuts there. Now waiting if the drive spins up anymore, but it does not seem to.

Improve this answer
1
  • Windows is really a mess...
    – marcolopes
    May 29, 2021 at 22:40
0

I had this exact problem and what fixed it was to switch the power source to the hard drive. My PSU was supplying inconsistent voltage.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .