I'm having a problem with windows constantly spinning up my secondary HDD. My main OS is on the C: partition of my SSD and on my HDD I have a D: partition for storage and an E: partition for recovery. Indexing is disabled for E: and D: and currently paused for all locations.
Setting the Windows power settings to turn off my HDD after 1 min of inactivity makes the drive spin down, but then wake up after around 20 s. When I set it to turn off after 2 min of inactivity it spins down very rarely, suggesting that there is something that is accessing the HDD at irregular intervals between 1:20 ~ 2:00 min. I have identified a peak in the resource manager that corresponds to the HDD activity.
This peak is high if the HDD did have time to spin down and then was woken up by the process causing the peak. The peak is tiny (but still there) if the HDD never had time to go to idle. Under the bar "Disk Activity", there is no image that has "D:" or "E:" in its path, so all I can do is to watch the peaks in the graphics to the right, not identify the cause in the list.
Using Sysinternals Process Monitor, I filter for any process that includes "D:" or "E:" in its path, and this made me able to identify and disable the QueryFullSizeInformationVolume via the registry key NoLowDiskSpaceChecks. However, this process did not correspond perfectly to my HDD wakes and disabling it did not help. As of now, Process Monitor reports that zero processes are accessing my HDD.
After reading another thread, I also tried disabling my page file (even though it's located on C:), just to see if this would make any difference, but it did not. I also tried to disable the controller for the HDD in the Device Manager, but this just made my drive remain spinning constantly. When I installed Win 7 a few months ago, my drive stayed quiet until I clicked it in Explorer, so I there is something that has changed within the last few months either with Windows or with some third party software. However, the same behavior is present when starting Windows with all non-Microsoft services disabled, suggesting that third party software probably isn't the culprit.
As of now I'm pretty lost and searching the web isn't helping me. I might try to boot another OS from a USB, but If anyone has any advice that can point me to a solution of my problem I would be very grateful.
Best Answer
Base
Process Explorer has a special column that tracks the change of the number of bytes read or written by a process:
You might be able to capture the name of the process that is reading or writing data to your secondary HDD this way.
//Edit:
If you know that it is the System process that writes something to the external hard drive, you could trace what the process is doing in the Process Monitor:
Start/stop the capture with Ctrl+E.
Define some of those filters:
//Edit2:
Maybe you could track the thread ID associated with a certain IRP event and then track the thread that caused that IRP event: