Detecting source of external drive activity

Posted on 2009-04-24
Last Modified: 2012-05-06
Hi Guys,

How do I determine which process / application is accessing an external hard drive?

I attach my external hard drive via USB to my laptop (XP SP2).
My laptop was recently re-installed after the internal hard drive crashed.
(Currently no problems with any software).

Often it is idle for hours, but all of a sudden there's activity on the external drive.

I have nothing open or mounted from the external hard drive (I only use it to make backups at the end of the day - all files on the drive are ZIPed).

My AntiVirus application is also idle (no scans).

When I try to "Safely Remove Hardware" from the System Tray, it fails with this message:
"The device 'Generic volume' cannot be stopped right now..."  (I've tried this several times in succession)
At this stage I haven't accessed the drive at all.

Even when I kill the "Explorer" process in Task Manager, and then restart the "Explorer" process, the external drive still shows activity and I'm not able to un-mount it.

I've run virus scans on the drive, and no virus was found.
Question by:m0nk3yza
    LVL 3

    Accepted Solution


    You could use file monitor to determine processes and then ask google " xxx process info".
    LVL 23

    Assisted Solution

    Maybe a software application is causing this activity.

    Go into msconfig (start - run - msconfig) and click on the startup tab. Click on "disable all". Go into services. Check the "Hide All Microsoft Services" box, and then click on "disable all". Reboot.  Any change?
    If the problem goes away, you will need to go back into msconfig and re-enable startups and services individually until you find the culprit.  Start by re-enabling your av/firewall software...

    LVL 1

    Author Comment

    Hi Guys,

    Thank you for the response.

    FileMon doesn't seem to pick up "USB" devices.
    I filter out C:* and then access an application on the external harddrive (H:).
    FileMon doesn't seem to pick it up. I'll test it some more after reading the manual.

    I've cleared the startup of all entries and rebooted.
    As this issue happens sporadically, I'll only be able to say if that was the issue in a few days time.
    LVL 1

    Author Comment

    Reading the manual helps...
    I've managed to filter only for the removable drive.
    It seems the explorer process send a "QUERY INFORMATION" request to the drive, even when it's not in use.
    I'll keep on monitoring it with FileMon until it starts acting up again.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    Suggested Solutions

    It is only natural that we all want our PCs to be in good working order, improved system performance, so that is exactly how programs are advertised to entice. They say things like:            •      PC crashes? Get registry cleaner to repair it!    …
    As hardware bugs go, this is a strange one! I upgraded a laptop in December 2011 with a 512GB Crucial m4 2.5-inch/9.5mm SATA Solid State Drive (SSD), Crucial part number CT512M4SSD2: …
    This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
    Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    22 Experts available now in Live!

    Get 1:1 Help Now