Skip to main content

Processes and Files

The process list groups observed writes by the process that Windows reports. The Written value shows the amount recorded, and Share helps compare contributions.

Inspect a writer​

  1. Choose the drive on Write activity.
  2. Wait for writes to appear in Processes.
  3. Select a process. The Files panel changes to show files written by that process.
  4. Select an available entry to inspect the corresponding area of the map.
  5. Pause the display if you need time to compare the counters and highlighted blocks.

In Settings, Dim other blocks when something is selected controls whether unrelated blocks recede. With that option off, a frame marks the selected blocks instead.

Unavailable names​

Windows tracing does not always provide a usable process or file name. VisualDisk can show Process name not available or File name not available while still counting the observed write. An unknown name is not evidence of malware.

Interpret the workload​

Updates, downloads, browser caches and backups can generate writes during normal operation. VisualDisk observes these operations; selecting a process does not stop it or change its files. Investigate an unexpected writer in its owning application before deciding whether to change its behavior.