2

My external drives kept randomly spinning up for no reason. I disabled indexing and optimizing on them and did all other commonly recommended things, but it kept happening.

Then I installed Process Monitor and set up a filter to see exactly what was waking the drives up.

And it is the System (process) writing to the $LogFile and $Mft directories of those external drives, as well as in the main directory of the drives (path is just the drive letter). I have enabled show hidden files and folders, but I don't see those system folders, they are both in the main directory of the external drives.

I get that these are system folders that the system needs to write in, but why are they on my external archival drives? Shouldn't they be on C: ? These drives have no system stuff on them.

Also worth noting is that svchost.exe keeps trying to write to \System Volume Information\tracking.log.tmp in the external drives, but it says access denied and I don't think those attempts wake up the drives.

I should say that the drives are encrypted with Bitlocker with auto-unlock, so maybe that links them to the system drive somehow and triggers the activity?

Is there anything I can do to stop the system from waking up my external drives? I hope someone can help me out, these drives only get accessed a few times a week, so I really don't want to have them spinning 24/7, but if I configure them to spin down after an hour or so they keep getting woken up. Any help is appreciated, thanks!

Improve this question
5
  • 1
    These files are part of the NTFS file system: social.technet.microsoft.com/Forums/windows/en-US/… . Check the these external drives do not have other functions; e.g., storing Restore Points, Virtual Memory,, etc. answers.microsoft.com/en-us/windows/forum/all/…
    – DrMoishe Pippik
    Commented Nov 20, 2022 at 1:33
  • chicken-egg. does accessing the files ($LogFile and $Mft) wake the drive up, or does system access them because something wakes up the drive. maybe event viewer can help you determine this.
    – Joep van Steen
    Commented Nov 20, 2022 at 2:12
  • @DrMoishePippik Thanks, I did check and the drives are not being used for virtual memory (only the system drive is selected) or for virtual restore points. Anything else that could be causing this...?
    – qbccd
    Commented Nov 20, 2022 at 9:16
  • @DrMoishePippik I agree access to the NTFS MFT and LogFile are side-effects of the real culprit. Something keeps accessing those disks. That in turn causes "system" AKA the NTFS filesystem driver to update the disk. (Probably just updating the "Last Access Time" metadata for the root-folder.)
    – Tonny
    Commented Nov 20, 2022 at 10:16
  • If there is no resolution for the issue, consider how often the drives start. Some occasional use is actually an advantage, since mechanical parts can "freeze" if left in contact, unmoved for too long. If the drives are running more than a small fraction of system on-time, though, unplugging the USB connector and/or power supply until the data is needed is a work-around, and protects the drives from severe mains surges and malware. For that purpose, I've mounted a switched power strip in reach of my desk.
    – DrMoishe Pippik
    Commented Nov 20, 2022 at 20:59

1 Answer 1

Reset to default
0

Some application is writing or scanning the disk.

$Mft is the Master File Table, containing the list of all the files on the disk.

$LogFile logs all the metadata changes to a disk's file system.

You need to find out which application is doing that. It can even be the Windows Search Index service, or an application such as Voidtools Everything, or anything else.

To locate this application, you could use Process Monitor to monitor and log all actions on the disk. Process Monitor generates a huge trace file, but you can filter references to the disk in question, trying out several filters. This will tell you which process it is, and perhaps this process could be set to ignore this drive.

Improve this answer
4
  • Virusscanner and Everything (if you use that) are 2 other main candidates for access the disk.
    – Tonny
    Commented Nov 20, 2022 at 10:13
  • As I explained in my OP, I did install Process Monitor and all I am seeing is the System accessing $Mft and $LogFile. So it's Windows accessing them. I can't figure out why, I've checked everything it seems.
    – qbccd
    Commented Nov 20, 2022 at 14:33
  • Windows seems to have the habit of periodically checking the status of all the disks. If you truly wish the external drives to sleep, you could safely remove them.
    – harrymc
    Commented Nov 20, 2022 at 15:20
  • It's also important to note that each NTFS volume contains the $MFT and $Logfile (and some more) and so it's not a matter of moving these files to the C: drive. They're treated as files by the file system but at the same time an integral part of the file system.
    – Joep van Steen
    Commented Nov 22, 2022 at 23:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .