DiskMon is an utility which logs and displays all hard disk activity on a Windows system. You can also minimize DiskMon to your system tray where it acts as a disk light, presenting a green icon when there is disk-read activity and a red icon when there is disk-write activity.

Using standard filtering techniques it is not possible for a dynamically loaded driver like DiskMon to attach to hard disk device objects and see requests originating in file systems.This is because file system drivers open disk devices during system initialization and, unlike the I/O Manager, file system drivers send IRPs directly at these devices. The I/O Manager allows for file system filter drivers to attach to file system devices after initialization because it checks for attached devices whenever it is going to send an Irp to a file system, and will direct the Irps to them instead.

DiskMon overcomes this limitation by using the technique I've developed of driver function interception. DiskMon locates a disk device's driver object and replaces the driver's dispatch entry points with its own. The DiskMon filter functions pass Irps it sees onto the hooked driver, and also intercepts completion routines in a similar way so that it can see the results of requests

On Windows 2000 and higher Diskmon uses kernel event tracing. Event tracing is documented in the Microsoft Platform SDK and the SDK contains source code to TraceDmp, on which Diskmon is based.