FindDiskKiller

FindDiskKiller See what keeps using your disk. A native macOS investigation workspace for finding the app, files, and device behind sustained disk activity.

English · 简体中文 · 繁體中文 · 日本語 · 한국어 · Deutsch · Français · Español · Português (Brasil) · Русский

macOS 14+ · Apple silicon & Intel · 100% local processing

Download for macOS · Website · How it works · Privacy · Support

Start with the signal: see sustained activity before you investigate its cause.

FindDiskKiller is for the moment when your Mac is warm, the disk is busy, and a process list does not explain why. It keeps the investigation in one path: identify the application, inspect the locations it touches, then start a bounded trace when you need direct file evidence.

Follow the evidence

1. Find the application

Compare CPU, disk I/O, network, memory, and time-range trends in the application workspace. Sustained activity is easier to understand when the evidence stays attached to the app that produced it.

Ask first: which application is keeping the disk busy, and is the activity sustained?

2. Follow it to the locations

File Activity shows related locations, writable folders, open files, and recent changes. It gives you a useful next question without pretending that a changed path alone proves who wrote it.

Move from the application to the folders and files involved.

3. Trace only when you need proof

Start a time-bounded folder or file trace explicitly. The trace reports requested reads and writes, active files, rates, and the verified process sessions responsible for the requests.

Use direct tracing as a focused investigation, not as a permanent background watcher.

One workspace for the next question

• Now and Applications show who is active across CPU, disk, and network signals.
• File Activity and folder tracing show where requests are happening and which verified sessions made them.
• Storage Map explains how space is distributed across volumes, applications, developer tools, simulators, containers, and AI Agent data.
• Disks and History connect mounted volumes to physical-device activity and preserve longer-term trends.

AI Storage is explicit and reviewable. Codex and Claude data is measured only after you ask for analysis, attributed where the provider exposes a reliable identity, and never deleted by guessing from a path or writing directly to a database. Active or changed sessions remain protected.

Measurements stay honest

FindDiskKiller keeps measurements with different meanings separate:

• Application I/O is process-requested traffic; it is not the same as physical NAND traffic.