Ways to tell what process is accessing a file?

[4x4junkie]

I've got a problem with my 2nd (storage) hard drive waking up at random that for the life of me I can't seem to pin down.

Probably the best example that causes this is simply opening a tiny .TXT file on my Desktop using Notepad. 20-30% of the time it causes the 2nd drive to spin up. Other times it's opening a .JPG in the Windows picture viewer or a .PDF in Adobe (and not every time it does it either). WTF??

Is there some way I can find out what process is accessing what file on that drive so I can try to put a stop to it?
I purposely set the hard disks to power down after 30 minutes of non-use so that the drive isn't just spinning there for no reason all the time.


Windows XP, with two partitioned SATA drives installed (OS and all programs are on C:, the rest contain nothing whatsoever besides document files such as photos, mp3s, .pdfs, etc.).

Appreciate any help.
If anyone needs more system info, lemme know.

 

[Die.Fledermaus]

There are tons of good "under the hood" tools from the old NTInternals guy.
http://technet.microsoft.com/en-us/sysinternals/bb842062
You might look at DiskMon;
DiskMon is an application that logs and displays all hard disk activity on a Windows system

The other tools like the task manager replacement are very useful.

 

[black_sheep]

Process Monitor from the suite Die linked to is what we use @ work, really helps to track that stuff down.

 

[4x4junkie]

Well, I greatly appreciate the suggestions...
However I'm getting this funny feeling I may be in over my head on this one...
Disk Monitor seemed simple enough except it wasn't showing the programs that were accessing the disk. So I tried Process Monitor and now I'm fully lost.

Opening a .jpg file on my desktop in Windows Picture Viewer with PM running gives me a bazillion items for Explorer.exe accessing every object on my whole Desktop! (and there are items extending over to other parts of the system such as my storage drives too ("CreateFile D:\" "QueryDirectory D:\Folder" "CloseFile D:\" ?)... I guess this must be what's spinning the drive up? Why does Explorer access all these other things just to display a .jpg pic? Or am I not interpreting this right?)

I was hoping to find something obvious like maybe a component of Norton or some other program doing some sort of checking or data logging operation on the drive that I could then kill it off using msconfig.

 

[Die.Fledermaus]

When any program is called a search is made with the environment variable %PATH%

From the command prompt you can see using the set tool or just the path.

cmd.exe
set
path

 

[black_sheep]

I was gonna say it may be that the search indexing kicks on at that time. Supposed to make searching your machine faster, seems to mainly wear out your hard drive by running all the time.

 

[4x4junkie]

I was gonna say it may be that the search indexing kicks on at that time. Supposed to make searching your machine faster, seems to mainly wear out your hard drive by running all the time.

There's a checkbox on the Disk Properties window: "Allow Indexing service to index this disk for fast file searching"... which I've already unchecked it for each drive, and it made no difference whatsoever. Is there something else I should be looking for?

 

[black_sheep]

To really disable it try this -> click me
But I would only do it temporarily unless you don't search very often or don't mind it being a little slow, just do it long enough to see if it changes anything.

What is the output of the "path" command Die gave you? That's very likely as well, especially since your opening a jpg and not a program directly, it has to figure out and find what program to use rather than knowing where it's at.

 

[4x4junkie]

To really disable it try this -> click me
But I would only do it temporarily unless you don't search very often or don't mind it being a little slow, just do it long enough to see if it changes anything.

No workie on XP (no "Windows Search" service is listed. An item called "Indexing Service" shows "Stopped" though)

What is the output of the "path" command Die gave you? That's very likely as well, especially since your opening a jpg and not a program directly, it has to figure out and find what program to use rather than knowing where it's at.

You'll have to explain what I need to do, using the command prompt is mostly uncharted territory to me.

 

[black_sheep]

Ok maybe I should go back and RTFA. But if that's stopped I'm pretty sure it's the right service, which I guess means its not it.

To see what's in the path...
1) Start menu
2) Run...
3) Put "cmd" in the box
4) Click OK
5) Type "path"
6) Hit enter

If you can't copy and paste regular, you have to right-click and click "Mark" then click and drag to cover the area, then when you click off it will copy it.

 

[4x4junkie]

Says:

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\user>path
PATH=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem

C:\Documents and Settings\user>

 

[black_sheep]

Hmmm...I don't see any D:\ there. How much free space for each of your drives?

 

[4x4junkie]

Two physical drives each with two partitions
C:=18.7 GB free / E:=126 GB free
D:=28 GB free / F:=198 GB free

 

[black_sheep]

Try doing the below and see if there's anything in the "Paging File Size" column for the partitions on your second drive.

[Start] right click [My Computer] click [Properties]
Click [Advanced] tab then click [Settings] in the [Performance] section
Click the [Advanced] tab and then click [Change] under the [Virtual Memory] section

 

[4x4junkie]

All except drive C: are set to "No Paging File".

C: is set to "Custom size" with settings of 2046 (initial size) and 4092 (maximum).





.