Windows (Explorer.exe) Randomly Access $MFT (Master File Table) of other HDDs

[tomejo9937]

Hi,

I have couple of hard drives on Windows 8.1 and while I'm using Chrome/Firefox or something else, Explorer.exe randomly access to $MFT (Master File Table) of other internal or external harddrives, which I don't use at that moment.

I used Resource Monitor and SysInternals to see what happens but I only figured out the Explorer.exe access $MFT.

Windows Search Indexing turned off, PageFile turned off. There is not any programs on other drives. There is no background application and no antivirus.

The drives randomly spin up every couple of minutes. And they make noise, that's why I'm asking.

Can you please suggest me anything to find what causes/triggers that or suggest me to how to use properly SysInternals or anything else to see why Chrome and Firefox wants to reach other hard drives? (Such as how to setup a filter in Process Monitor / SysInternals or anything else... )

 

[Slavic]

To check which process uses the particular drive, use Process Explorer (start it in administrator mode), Find menu, type a drive letter:, e.g. d:
Most often it will be not Explorer but System (called by Explorer in particular).
To check which operations target your drive, use Process Monitor, then in the filter add Path - contain - d: - include, and also exclude all other existing drives (e.g. c: ). Select at least File System Activity on the toolbar.

Usually Chrome and Firefox don't attempt to check the additional drive(s) during normal browsing, they may ask for drive list only when you attempt to download a file or use the Save as... dialog. However, they may check the particular drive if you configured to memorise the last saving location instead of common ...\Downloads. It can be easily fixed.

 

[tomejo9937]

Thank you Slavic for your help.

I tried what you suggested: "Process Monitor > Filter > Path - contain - N: (drive) - include"
I excluded other drives and selected File System Activity button on toolbar.

The result:
I was reading an article in a website in Firefox for about 30 minutes than I opened a new tab in Firefox (an household electronics company's website); and immediately the N: drive started to spin up. I checked at the same time the Process Monitor and I saw this:

Process Name: System
Operation: ReadFile
Path: $MapAttributeValue
Result: Success
Detail: Non-cached, Paging I/O, Synchronous Paging I/O

So, in this example, I never tried to save anything; just opened a new tab.

By the way, save directory is C:\Downloads (Operating System drive, SSD)

Can you please suggest me anything to figure out what triggers the other drives?

I really appreciate any help.

 

[tomejo9937]

New Update:

I wanted to see if Chrome access to that drive.

I closed Firefox and when I opened Chrome, Chrome also wanted to access that drive:

Process Name: chrome.exe
Operation: CreateFile
Path: N:\Desktop.ini
Result: Name Not Found
Desired Access: Generic Read
Disposition: Open
Options: Synchronous IO Non-Alert, Non-Directory File

Then I re-opened Firefox and it also wanted to access N:\Desktop.ini:

Process Name: firefox.exe
Operation: CreateFile
Path: N:\Desktop.ini
Result: Name Not Found
Desired Access: Generic Read
Disposition: Open
Options: Synchronous IO Non-Alert, Non-Directory File

10 seconds later:

Process Name: System
Operation: ReadFile
Path: N:\$Mft
Result: Success

20 seconds later, this time, another drive accessed: T:\ Drive

Process Name: System
Operation: ReadFile
Path: T:\$Mft
Result: Success

So, Firefox and Chrome wants to access other drives; sometimes to Desktop.ini, sometimes $Mft, sometimes $MapAttributeValu.

There was Desktop.ini in N: Drive but I removed it. The file was empty and I thought that if I remove it, maybe the system will not try to access it. But actually, the system is still trying to access it.

Any help will be much appreciated.

 

[Slavic]

Indeed it's strange. According to your data, these are the direct calls from browser programs, not a system call which has been triggered or scheduled (antivirus scan, rebuilding of the search DB etc). But the reason to check the file Desktop.ini is not clear, its content is used to display the look of the particular folder of drive in the Explorer window.

I tried to reproduce this behaviour on my PC with the external USB SSD and it didn't happen. Opening a new tab in Chrome doesn't result in any request to this drive, nor it has a Desktop.ini in the root directory. I can suggest to check and do this:
1) Maybe your additional drive has been added to the Explorer's Library. If so, exclude it or its particular paths from the Library.
2) Disable the indexing in the drive properties, even if you switched off the indexing on the system level.
3) Temporarily disable all extensions in the browser (at least in Chrome it can be easily done without uninstallation).
4) Disable file sharing in OS, HomeGroup and Server service (it usually helps when an external drive cannot be safely removed).

If nothing above helps, it may be a built-in browser behaviour. You can attempt to trace it in Process Monitor, adding to the filter the browser executable and checking when (and why) browser asks OS for the list of existing drives before calling these drives directly. But I doubt that I can help much in such case, maybe you need to ask Google/Mozilla support or other people experienced in this area.