external hard drive being accessed, but why?

On my XPH SP3, with a fairly fresh recovery (using the OEM partitioned D drive's recovery files about 2 wks ago and it hasn't accessed the internet but very rarely), while I had two EHD's online, each one having a folder open, except I was not managing (in any other way) either of the two folders for these two external hard drives, I was using a video editer on a file that again was not related to any external hard drive, but for some time I was hearing one of these two the EHD's chugging away as if it was being accessed.

I checked the event viewer's system, application and security logs, but nothing lists at the moments I noticed the EHD 'being accessed'. Additionally I do not have system restore monitoring any drive, even the laptop itself, nor am I using a USB hub, plus I've even disabled my WLAN adaptor, so I think it extremely odd that the EHD would be chugging away.

I even checked Norton's (NAV20210) full history as well as scan reports and nothing lists there that was occurring when the EHD was 'being accessed'.

This seems fairly suspicious, but being the 'advanced novice' that I am, I've likely not the experience and/or probably too, not the tools to go about verifying and/or tracking down why it is that a EHD of mine is apparently 'being accessed'.

The only event log entries that were even close to this time, happened when I'd used 'safely remove hardware' to disconnect both the EHDs.

That log's "security" event's lists a pair of 'success audit', with a "User: NT AUTHORITY\NETWORK SERVICE", first one being a "security" sourced event, catagory being "logon/logoff", it's event ID "528', with logon type "5", logon process "advapi", and the logon GUID (listed in the event viewer) is blank, save for a dash symbol.

A split second later another security log entry…

Event Type: Success Audit
Event Source: Security
Event Category: Privilege Use
Event ID: 576
Date: 4/13/2010
Time: 5:53:10 PM
User: NT AUTHORITY\NETWORK SERVICE
Computer: DREAM11A
Description:
Special privileges assigned to new logon:
User Name: NETWORK SERVICE
Domain: NT AUTHORITY
Logon ID: (0x0,0x3E4)
Privileges: SeAuditPrivilege
SeAssignPrimaryTokenPrivilege
SeChangeNotifyPrivilege

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

I supppose I'll try recreating the questionable access, open up task mgr and process explorer, but if anyone had any input on what to look for thereor elsewhere (in lay terms), I'd sure appreciate hearing from you as the definte sound of data being manipulated on my EHD is of some concern.


Happ-e-trails to all,

wguru

I wonder if Indexing is turned on for the external drives?

Right click on the drive and select Properties. See if the Allow files to be indexed box is checked. If so, uncheck and see if that resolves fixes it.

That's funny, after posting and a nap, I thought of that.

Problem is, I looked at both those EHD's properties and neither's 'indexing' is ticked.

Also, I might have mentioned that there's known malware that uses or creates a file named advapi.exe and I'd already ruled that potential causation out after a thorough search evidences no such file on my system and/or on either EHD., ref. the best search utility I've ever found ("Search Everything").

Perhaps the simplier approach to these sort of things, no doubt would be in a utility that chronologically lists "last accessed" files/folders.

I have a copy of "Karens Directory Printer Installer" (ptdirpm-setup.exe) that as I recall, and just confirmed, will do just what da docktor ordered.

Karen's Directory Printer can print the name of every file on a drive, along with the file's size, date and time of last modification, and attributes (Read-Only, Hidden, System and Archive)! And now, the list of files can be sorted by name, size, date created, date last modified, or date of last access.

http://www.karenware.com/powertools/ptdirprn.asp

Version 5.3.0.2 has a MD5 hash of 87216853F1931E66C92DC974F72D4919

But thanks for the reply.


wguru