How to find what's writing to your Mac's disk

To find what is writing to your Mac’s disk, use a process list with a Disk column and sort it. The app at the top is the one reading and writing the most right now. In Foreman that column is on the Processes page, and App History adds a running total of disk read and written for each app since it opened, which catches the quiet writers that a single glance misses.

Most heavy disk activity on a Mac is one of a short list of background jobs doing their normal work: Spotlight indexing, a Time Machine backup, Photos analysis, a browser, a sync client. This post shows how to tell which one it is, and when it is worth acting.

First, is it a problem?

A busy disk is not a fault. Disk use is bursty by nature, and a Mac that writes a lot for ten minutes after you install an app or a macOS update is behaving as designed. It becomes a problem in three cases.

• The Mac is slow while it happens, and the slowness lasts more than a few minutes.
• It writes constantly with nothing happening, for hours.
• You are short of free space, and something is filling it.

If none of those applies, leave it. If one does, find the writer.

Find the writer

Open the Processes page in Foreman and click the Disk column header. Above the column is the whole Mac’s total, so you can see how much activity there is, and the rows underneath show who accounts for it. An app’s helper processes are added into the app’s row, so a browser or a chat app appears as one line. Copies of the same background program share one row with a count, such as “Spotlight file reader (4)”, which saves you adding them up.

Look for a row that stays at the top for more than a minute. A name that flashes up and is gone is normal.

Foreman’s Disk column shows disk use for processes that run under your account. Processes owned by root or a system account, such as Spotlight indexing and Time Machine, show no disk figure, so if the Performance page’s Disk graph is busy and nothing in your own list explains it, those two are the likely writers. The column does not show which files are being written. It names the writer, and the name is usually enough to know what to do.

Without a process list, the practical check is to go through the usual suspects below and see which one fits what the Mac was doing when the disk got busy.

The usual suspects

Spotlight. After a macOS update, a big file move or adding an external drive, Spotlight builds or updates its search index. Foreman names mds_stores “Spotlight indexing” and mdworker and mdworker_shared “Spotlight file reader”: they read new and changed files so Spotlight can search them. It can run for hours on a large drive and then stops on its own. What is mds_stores on a Mac and what is mdworker_shared on a Mac cover it.

Time Machine. backupd is Time Machine’s backup, and it writes to your backup drive, but it also reads a lot from your own. The first backup is the biggest, and later ones are smaller. It decides when to run through a scheduler, backupd-helper. What is backupd on a Mac explains it.

Photos. photoanalysisd finds faces, scenes and memories in your library and runs mostly while the Mac is idle. mediaanalysisd analyses photos and videos for search, Live Text and Visual Look Up. After you import a large library, expect both to be busy for a while. What is mediaanalysisd on a Mac is the one people ask about most.

Browsers. A browser caches pages, images and video as you browse, and Chrome and Safari both write to disk as they go. A browser with many tabs, or one streaming video, can sit near the top for a long time. That is normal.

Cloud sync. iCloud Drive, Dropbox and Google Drive write the files they download. A folder being synced for the first time can write for hours. Foreman’s names for the macOS side are iCloud Drive (bird) and Cloud files (fileproviderd).

Updates. Downloading and unpacking a macOS update writes many gigabytes. softwareupdated and the update downloader are the names to look for.

Your own work. Video editing, a compile, a game installing, a virtual machine: heavy writers by design, and the writes follow what you are doing.

What a running total shows that a snapshot does not

The Disk column shows the present. A burst that ended five minutes ago is gone from it. App History is the other half: for each app, it shows how long it has been open, and its Disk read and Disk written since it opened, along with CPU time, Network and Energy.

Sort App History by Disk written. An app that has written a very large amount over a day is the one to look at, even if it never appears at the top of the live list. A browser that has been open for a week can look quiet at any moment and still sit at the top of the total.

Two limits, so you read it correctly. The totals last as long as the app stays open. They are not kept after the app quits, so a Mac you restarted this morning only shows this morning. And Foreman does not keep a history by process across weeks.

What you can do about it

Wait. Spotlight, photo analysis, a first backup and a macOS update settle on their own. Plugged in, with the Mac awake and left alone, they finish sooner. Interrupting them only means they run again later.

Pause the source. If a sync client is the writer, pause it from its menu bar item. If a download is the writer, pause the download.

Quit what you are not using. An app writing in the background that you do not need is a reasonable thing to quit. In Foreman, End Task asks the app to quit the way Command-Q does, so it can save your work. If you would rather not lose the app’s place, try the next option.

Efficiency Mode. For an app you need open and do not need right now, Efficiency Mode runs it at background priority while it is in the background, with its disk use turned down, and holds it to about a quarter of the processor time it would otherwise take. In front, or while it is playing sound, it runs at full speed. It is remembered per app. How much difference it makes depends on how busy the Mac is. Do not use it on something that is meant to finish a job fast, such as an export you are waiting for. It also works on macOS’s own background processes that run under your account, such as Photos analysis and Media analysis. It is not offered for processes owned by root or a system account, which include Time Machine’s backupd and Spotlight’s mds_stores; the User column shows who owns a process.

Do not end the system’s own jobs. mds_stores, backupd and photoanalysisd are macOS’s, and macOS starts them again when it next needs them. Ending one usually just means the work starts over later. If one will not finish, a restart is a better reset than a kill.

When the disk keeps filling

If the question is space and not activity, that is a different job. System Settings > General > Storage shows what is using the space by category, and it is the right place to start. A process writing steadily is one cause. Large caches, old backups and big downloads are the more common ones.

Foreman does not analyse disk space and does not clean files. It shows who is reading and writing. It costs $12 once and is free for 24 hours, and the Spotlight, Time Machine and Photos jobs above are worth recognising even if you never install it.