So ive gone through the ringer trying to stop my external drives from being up more than not. They're waking over and over if they even get a chance to spin down.

TortoiseSVNCache was one culpprit. User Assist for frequently accessed files was another.

I'm now left with this guy.

enter image description here

The weirdest part is that drive, its a plex media drive. So is Q but its not seeing all those odd points being accessed.

Can someone tell me what they are and how to make it stop?

EDIT: Oh boy. ive pared this down much further. I watched these fire off as all 4 of my externals woke up sequentially. These are definitely the culprit. Anyone able to identify? Whatever is causing $Mft and $Logfile I cant even get 15m of sleep out of my drives.

Theyre not indexed, i have background services disabled in windows10. I turned off frequently used apps in the start menu. I disabled tsvncache and tgitcache from all but my system drive. Windows is impossible.

enter image description here

  • 1
    $Extend is a folder created by Windows, I have seen these alot using a recovery software I have had since Windows XP. I see them mostly on NTFS hard disks. Svchost is just reading and writing to the files. This $Extend folder is where Chkdsk finds the logs $UsnJrnl (USN Journal), $Reparse, $ObjId and $Quota among others. "The USN Journal (Update Sequence Number Journal), or Change Journal, is a feature of NTFS which maintains a record of changes made to the volume."-Wikipedia.org en.wikipedia.org/wiki/USN_Journal – vssher Mar 27 at 5:04
  • It's a folder created by NTFS, because NTFS was designed to store its internal metadata within actual files... (It inherited that from OpenVMS Files-11.) You'll get the same $files and $Extend folder on any NTFS volume whether you're using Windows or not. – user1686 Mar 27 at 6:02
  • I do use macrium reflect, but i still cant understand why (and ive let procmon run for hours) its wanting to harass that drive and none of the others. will dig deeper – klepp0906 Mar 27 at 11:37

All those events are caused by a single service host process, and likely by a single service running in that process. Double clicking on any of the event lines should open the event properties dialog, and the stack tab therein will contain information about which executable module (.exe or .dll file) is causing the event. It shouldn't be too hard to correlate the module name to a specific service running in Windows. You may be able to simply disable that service, although doing so could conceivably have unwanted consequences.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.