Identifying What Program Is Accessing A Drive?

Discussion in 'Windows 10' started by DeathStalker77, Sep 12, 2018.

  1. DeathStalker77

    DeathStalker77 MDL Addicted

    Nov 8, 2009
    552
    40
    30
    Hello all!

    I have multiple (as in over a dozen) drives in my system. Sometimes I notice the temp on a couple drives rising, even though I have them excluded from stuff like Search, Indexing, Defrag, AV, etc.

    I've yet to find a program that will show me what program is specifically accessing a drive - and yes, I've also tried System & Process Explorer.

    Any ideas?

    Thanks!
     
  2. l33tissw00t

    l33tissw00t MDL Addicted

    Dec 6, 2012
    819
    520
    30
    OpenedFilesView (nirsoft)?
    Procmon or Sysmon (sysinternals)?
     
  3. DeathStalker77

    DeathStalker77 MDL Addicted

    Nov 8, 2009
    552
    40
    30
    Pumpernickle wouldn't do, but it looks like Process Monitor (ProcMon) just might. Though the interface could use some refinement (you can't click & sort on a column, you have to filter for a value, and that actually takes quite a while to do).

    OpenedFilesView appears to do it as well, and you can sort by diff columns.

    Oddly on the drive in question, all it shows is SYSTEM PROCESS accessing the metadata ({Drive Letter}:\$Extend\$RmMetadata\$TxfLog .....not sure on why that would make my drive temp spike ..... :(
     
  4. Mr.X

    Mr.X MDL Guru

    Jul 14, 2013
    8,575
    15,646
    270
    Did you actually try it?
     
  5. DeathStalker77

    DeathStalker77 MDL Addicted

    Nov 8, 2009
    552
    40
    30
    No, I didn't - I read the program's description on the site. It would appear to be more of an intrusion monitoring software, which is not what I am looking for.