Monitor Disk Activity in Windows

I’ve had no trouble finding processor, memory and network monitoring tools on Windows. Process Explorer from SysInternals does a great job of showing processor and memory use (overall and for each process) and NetStat Live displays incoming and outgoing network traffic. The only thing missing was an easy way to see what processes were using the disk.

Every once in a while my hard drive begins churning and it’s a little disconcerting to have no idea what it’s doing. Nothing stands out with high CPU or memory use and the network traffic is all but nil.

I searched high and low for a tool to show processes ordered by current disk activity and eventually found what I was looking for in Process Explorer. The trick is to enable the following three columns one column: I/O Delta Total Bytes

  1. I/O Delta Reads
  2. I/O Delta Writes
  3. I/O Delta Other

I didn’t know about the I/O Delta Other until I was running a disk scan. It was scanning thousands of files so there was obviously disk usage, but the process had no reads or writes. I turned on other and it shot to the top of the list with a few hundred a second.

Next time your hard drive starts churning and you want to know what’s causing it, get Process Explorer, go to View -> Select Columns, Process Performance and enable the three columns column I mentioned above. Click on the column header and the offending process will leap to the top.

Select Columns Dialog

Update 11 Oct 2012 – You can also use the Disk Activity tab in the built-in Resource Monitor. Instant Fundas has more details.


 (Post a comment) | Comments RSS feed
  1. Nice tip, thank you

    Comment by Marek on May 31, 2008 @ 11:06 am
  2. You’re welcome. I’m glad you found it useful. :)

    Comment by Dan on May 31, 2008 @ 4:04 pm
  3. Thanks!

    Comment by Eric Roth on October 11, 2008 @ 3:58 pm
  4. Lots of disk activity seems to be originating from svchost.exe (windows services host process). Now, this hosts many services, and procexp.exe can’t drill down to determine which service specifically is causing the disk activity! Any ideas?

    My poor hard drive is being hammered, and has been for the past hour or so, with thousands of seeks per second. This is destroying my drive, and I want to find out how to stop this!!!

    Comment by Anoncow on February 11, 2009 @ 12:43 am
  5. @Anoncow If you mouse over svchost.exe in procexp it will display a list of all the embedded services. Then you can disable each service one by one until your disk stops thrashing.

    Comment by Dan on February 11, 2009 @ 7:55 am
  6. Excellent tip!

    I’ve used Process Explorer for a long time. I always just displayed the I/O Reads/Writes/Others … that only gave the total. This gives the current active … that’s what I wanted all along.

    Greatly appreciated!

    Comment by Tod on March 18, 2009 @ 9:50 am
  7. This is usufule, thanks.

    Comment by AndreaR on March 26, 2009 @ 4:59 am
  8. Thanks so much for this tip. Mysterious constant disk activity was driving me crazy.

    Comment by Geoffrey H. Goldberg on April 20, 2009 @ 12:20 am
  9. Thanks so much! A really useful tip.

    Comment by Sian on February 12, 2010 @ 4:45 am
  10. Cool

    Exactly what I was looking for. Thanks

    Comment by Michael on March 8, 2010 @ 9:51 am
  11. You’re welcome :)

    Comment by Dan on March 8, 2010 @ 9:52 am
  12. At least with Process Explorer v11. 33, the word “Bytes” is added to the column name, as in “I/O Delta Read Bytes.” I mention this in case you are looking for “I/O Delta Read” and can’t find it :).

    Also, the most useful column for me is “I/O Delta Total Bytes.” That sums the three others (read, write, other) into a single column. I use just that one and not the other three.

    It is amazing to me that the #1 complaint users have is that there computer is running slow, and most of the time it is becuase of excessive hard drive activity, yet 1) manufacturers make the hard drive activity light tiny and hard to see and 2) Windows does not include a HD activity monitor (until you install Process Explorer. I wish mfgs would put a big HD activity light on the monitor frame.

    Also, the many culprits recently have been indexing and backup programs. Even though they all claim to stop or slow down when the computer is in use, that never seems to happen.

    Why can’t the designers fix these things? Oh well, job security for techs like us.

    Comment by David Reichard on March 19, 2010 @ 1:22 pm
  13. @David The total delta bytes column is brilliant. I’d never noticed it until now. Thanks for pointing it out!

    You’re right, most of the time when my machine is sluggish, it’s due to some sort of disk activity (usually periodic backups or a scan)

    For my next machine I plan to get a small but blazingly fast SSD for the OS, and a larger regular drive for everything else. Though, if SSD prices come down, I’d go with one big SSD.

    This video shows just how fasts SSDs can be (when RAIDed)

    Comment by Dan on March 19, 2010 @ 2:20 pm
  14. Great!!. Sun Java quickstart was killing my computer (apparently scanning for JRE files) I disabled service and computer works MUCH better.

    Comment by Charlie on April 5, 2010 @ 10:34 pm
  15. @Charlie That’s a common one. And I believe when Java is updated that gets re-enabled so make sure you check it occasionally.

    Comment by Dan on April 6, 2010 @ 12:50 am
  16. Unfortunately, this page says it’s not about the disk activity only, but also network and other devices. So my quest for such a disk monitoring tool has not ended yet :(

    Comment by lucian ciufudean on May 17, 2010 @ 5:37 am
  17. @lucian Thanks for the info. While I understand your concern, from my experience, whenever I’ve had heavy disk usage the offending process has been at the top when sorted by this column. It has always worked as a disk monitoring tool for me.

    Comment by Dan on May 17, 2010 @ 8:32 am
  18. This is exactly what I’ve come conclude myself, being the column mentioned by the tool called procexp.exe (process explorer) … but, I’m having two problems :

    – The numbers displayed get auto-converted to KB, MB, whatever. If you have a quick changing display, it’s impossible to read, since large numbers (usually the ones with MB’s) do not jump out, next to KB, or whatever.

    – There is no graphical display of high disk usage (while there is for CPU usage). It’s obvious procexp is meant for CPU usage, not disk usage, but it would be nice … often, I see my computer being extremely busy, but all is on disk, nothing on CPU, and then the grpahs tell me : all is OK. But I know it isn’t.

    DiskMon is not really interesting, it looks like scrolling info only, which may be good for debugging, but not for info.

    Comment by t on May 21, 2010 @ 5:45 am
  19. @t Those are both good points. For the first issue you can slow down the update speed (View -> Update speed) so it’s easier to see them before they change (or you can pause the display). I don’t know of a good solution for the second issue.

    Comment by Dan on May 21, 2010 @ 5:49 am
  20. My version of process exporer 11.20 has a graphical i/o graph similar to the CPU one.

    Check this tool: Free Extended Task Manager – it has a dedicated column Processes/Disk Load. And compared to process explorer I don’t see gmail notifier and yahoo messenger in the top 10 disk users, which leads me to think that compared to process explorer, this is really measuring disk (not all i/o) usage

    Comment by lucian ciufudean on May 25, 2010 @ 6:22 am
  21. Cool, thanks for the point lucian.

    Comment by Dan on May 25, 2010 @ 8:54 am
  22. Thanks for the tip. Very useful.

    Comment by Dale77 on June 29, 2010 @ 4:07 pm
  23. @Dale77 You’re welcome.

    Comment by Dan on June 29, 2010 @ 4:14 pm
  24. This was a great tool to find out what process is keeping the I/O busy. Have you found any way to drill down to specific files that are causing the I/O?

    I have a file server that many users use. Currently trying to figure out exactly which files are taking up the most I/O and causing the whole network to slow down… Haven’t found anything that would show me that.

    Comment by Eugene on July 1, 2010 @ 11:18 am
  25. @Eugene That’s a good question. I haven’t looked yet, but I’m not aware of any tools to do that offhand.

    Comment by Dan on July 2, 2010 @ 9:31 am
  26. Bravo!! I have been using procexp for quite some time, but never notice the total delta bytes. It will now be a standard setting for me.

    Comment by rick on September 28, 2010 @ 6:31 pm
  27. Hi,
    I am troubleshooting a recommendation from Microsoft – where the Avg disk read\write\trans per sec should be less than 50ms.

    i found that several servers – win2003 sp2 standard ed (with similar or different soft installed) – exceeds this value up to values such as 100-200 MS or even 660 ms

    my question is the following – how to can analyze processes activities in terms of disk usage?
    i want to find which process effects the “disk read\write\trans per sec” the most – can i use this application for this troubleshooting?

    thanks in advance for any advise\assistance…


    Comment by Tamar on January 27, 2011 @ 5:46 am
  28. @Tamar It would probably work, but procmon can give you even more detailed information about an individual process.

    Comment by Dan on January 27, 2011 @ 8:15 am
  29. Is Process IO column not the sum of file, network and device IO?
    How can you distinct the disk IO only with this column?

    Comment by GDS on March 21, 2011 @ 5:24 am
  30. @GDS In Process Explorer 14.1 there are three Delta Total Bytes fields

    1. Process I/O
    2. Process Network
    2. Process Disk

    Process I/O is not the sum of network and disk. They are 3 distinct values.

    Comment by Dan on March 21, 2011 @ 12:26 pm
  31. I have found the solution on some other forum. It is KB956438,

    After applying this and rebooting, the problem is gone!!

    Comment by Jovke on April 26, 2011 @ 6:33 am
  32. @Jovke What problem, exactly, is gone?

    Comment by Dan on April 26, 2011 @ 9:30 am
  33. My computer had slowed to a crawl. Turned out to be indexer. Modified and back to normal.

    Comment by pydevotee on January 5, 2012 @ 1:52 pm
  34. This post allowed me to set up Process Explorer exactly as I needed to. I have long wanted this feature and, despite being a long-time user of PE, I was not aware that this option existed. Thank you!

    Comment by Nick Mash on August 19, 2012 @ 4:11 am
  35. @Nick Mash Thanks for your comment, it’s great to hear the post helped you out.

    Comment by Dan on August 19, 2012 @ 3:26 pm
  36. I was hoping to find something to show when one of my external drives were being accessed (because either my sleep mode is broken, or something is constantly doing something to keep it busy).

    I do not spot this information in this tool. Is it there and I missed it, or do I have to look elsewhere?

    Comment by Linus on October 14, 2012 @ 6:39 am
  37. @Linus This method shows the disk usage of processes, regardless of where it is. For instance, I just copied a number of files from my internal hard drive to my external hard drive, and the utility I used to copy (Teracopy) showed up at the top of the Disk Delta Total Bytes.

    Comment by Dan on October 15, 2012 @ 10:07 am

Comments are closed