Why your Mac's disk is busy when you're not doing anything

27 October 2026 · 5 min read

When your Mac’s disk is busy and you are not doing anything, it is almost always background work that macOS saves for quiet moments: Spotlight indexing, a Time Machine backup, iCloud syncing, Photos analysing your library, or an update downloading and preparing. Most of it is harmless and ends by itself. The way to know which one it is is to look at which process is reading or writing, and the way to deal with it, in most cases, is to wait.

This post goes through the usual suspects, how to tell them apart, and the few times it is worth stepping in.

Why a Mac does heavy work when you are idle

macOS is designed to push chores into the gaps when you are not using the Mac. A backup, an index rebuild or a photo scan competes with whatever you are doing, so the system waits for you to stop. That is why the disk activity you notice often starts when you walk away, or right after you close the lid and open it again.

So a busy idle Mac is often a Mac doing its housekeeping on schedule. The question is whether it is the ordinary kind, and whether it is taking too long.

The usual suspects

Each of these has a process name, and these are the ones to look for.

Spotlight indexing. mds_stores builds and updates the search index, and mdworker_shared programs read new and changed files for it. This is busiest after a macOS update, after you copy in a large number of files, or when you plug in a drive. Several copies of the file reader at once are normal. What is mds_stores on a Mac? Spotlight indexing explained has the detail.

Time Machine. backupd runs the backup, and backupd-helper decides when to run it. The first backup to a new drive is the long one, because it copies everything. Later ones copy only what changed. You can see its state in System Settings > General > Time Machine, and the whole story is in What is backupd on a Mac.

iCloud and cloud drives. bird syncs iCloud Drive, cloudd syncs app data with iCloud, and fileproviderd connects cloud storage, including iCloud Drive, Dropbox and Google Drive, to Finder. Signing in to a new Mac, or moving a big folder into a synced location, starts a long sync.

Photos analysis. photoanalysisd finds faces, scenes and memories in your library, and mediaanalysisd analyses photos and videos for search, Live Text and Visual Look Up. Both do most of their work while the Mac is idle, and a large or newly imported library keeps them busy for a long time.

Updates. softwareupdated checks for and downloads macOS updates, and softwareupdate_download_service fetches them. After a major update installs, Spotlight and Photos often get busy again too, so one update can set off several of the above.

Security checks. XProtect, Apple’s built-in malware scanner, checks apps and runs its own periodic scans. Its bursts are usually short compared to the others.

How to tell which one it is

Guessing from the time of day is unreliable, so look.

In Foreman. Start on the Performance page: the Disk graph shows the whole Mac’s reads and writes with a minute of history, so you can see whether the disk really is busy. Then go to the Processes page, where Foreman shows plain names with the real name beside them in grey, so mds_stores reads as “Spotlight indexing” and photoanalysisd as “Photos analysis”. Click the Disk column to sort for processes that run under your account, such as Photos analysis or iCloud Drive. Processes that belong to root or a system account, including Spotlight indexing and Time Machine, show no disk figure, so for those click the CPU column instead: indexing and backups use the processor as well as the disk. Foreman is free to try for 24 hours.

In System Settings. For free checks that need nothing installed: General > Time Machine shows whether a backup is running, and General > Storage tells you whether the disk is nearly full, which makes every task slower. Photos, Dropbox and Google Drive show their own sync progress in their windows or menu bar items.

In Terminal. top -o cpu sorts running processes by processor use, which often points at the same process that is using the disk, because indexing and scanning use both. Its CPU figures count each core as 100 percent, so a busy process can read above 100. Press q to leave it. It is a rough pointer, not a direct disk reading.

Should you let it finish

Almost always, yes. These jobs are the Mac doing something useful, and stopping them halfway usually means they start again from the beginning later. A few notes:

A first-time Time Machine backup, a first iCloud sync, and a Photos analysis of a large library can each take a long time. Leaving the Mac plugged in and awake overnight lets them finish.
macOS holds back some of this work on a laptop running on battery, so a Mac that seems quiet on battery may get busy when you connect power.
After a macOS update, give it a day or so before deciding something is wrong.

When it is worth stepping in

Three situations call for action.

It never finishes. If the same process is busy for days with no change, restart the Mac and watch again. If it comes back at the top, the cause may be something specific, such as a damaged index or a very large library, and a search for that process name with your macOS version is the next step.
The disk is nearly full. Background work needs room. Free space in General > Storage first.
It makes your work slow right now. You can turn some of it down rather than stop it. Several of these run under your own account, including Photos analysis (photoanalysisd), Media analysis (mediaanalysisd) and iCloud Drive (bird), and Foreman’s Efficiency Mode works on those: the process runs at background priority with its disk use turned down until you turn the mode off. How much that helps depends on how busy the Mac is. Spotlight indexing (mds_stores) and Time Machine (backupd) run as root, the system’s own account, so Efficiency Mode is not offered for them; Foreman’s User column shows who owns a process. For a backup, Time Machine’s menu bar item offers Skip This Backup while one is running.

What not to do is end system processes such as the Spotlight ones to stop the noise. macOS will start them again by itself, and ending the wrong one can cost you a login session. If you need to know which processes are safe to end, see How to end a background process on a Mac.

Summary

A busy disk on an idle Mac is usually Spotlight, Time Machine, iCloud, Photos or an update, and it usually ends without help. Find the process that is doing it by sorting a process list by disk use, or by CPU for system processes that show no disk figure, match it to the list above, and let it finish unless it never ends or the disk is full. To work out what is writing to the disk in more detail, read How to find what’s writing to your Mac’s disk.