Three layers of measurement

FindDiskKiller organizes information into three layers. Understanding the distinction helps you interpret what the numbers mean and where their limits are.

Application layer

What you see: app CPU, disk reads/writes, network sent/received.

What these numbers mean:

  • Disk I/O is the total across all disks, as reported by the kernel for that process. It is not the NAND write count of a specific SSD.
  • CPU can exceed 100% because macOS reports CPU per core. A multi-threaded app using 2 full cores shows as 200%.
  • Network is split into download and upload so you can distinguish between fetching data and syncing or uploading.

Device layer

What you see: physical device throughput and the relationship to mounted volumes.

What these numbers mean:

  • Device counters reflect actual bytes going through the I/O subsystem.
  • This is not the same as summing up per-process I/O. Caching, APFS copy-on-write, filesystem metadata, and kernel activity all consume device I/O that is not attributed to any single app.
  • Device throughput numbers are separate from process I/O numbers. Comparing them directly will not balance out.

File layer

What you see: recently modified files, open file locations, and on-demand access tracing.

What these numbers mean:

  • “Recently modified” comes from FSEvents. It shows that a location changed — it does not, by itself, prove which process made the change.
  • File access tracing records the bytes an app requested from the system (read or write system calls). The actual physical I/O may differ due to caching, APFS snapshots, compression, and memory-mapped I/O.
  • When tracking is stopped, the trace ends cleanly. Gaps in data are shown as “data unavailable” rather than zero — so you can tell the difference between no activity and missing information.

CPU and the 5-second rate

The “last 5 seconds” rate is computed from two samples taken 5 seconds apart. It reflects the most recent activity window, not a smoothed average, and can fluctuate rapidly during bursty workloads.

What “unavailable” means

Some fields may be unavailable because:

  • The device does not report that SMART/NVMe attribute (many external USB enclosures, for example).
  • You have not granted the required permission.
  • Tracking was stopped or has not been started.
  • The requested information is not exposed by macOS.

When data is unavailable, the UI shows it as unavailable, not as zero.

Why per-process disk I/O does not equal SSD NAND writes

The I/O numbers shown for each process are the bytes the process asked the kernel to read or write. Between the process and the physical NAND flash there are multiple layers: the unified buffer cache, APFS copy-on-write and snapshots, the SSD controller’s internal write amplification, garbage collection, and wear leveling. None of these are attributed to a single process, which is why process I/O counts should be thought of as “requested I/O” rather than physical media consumption.