Abstract: Based on Windows NT(5.0) OS,it can monitor the Read-and-write performance of disk under Windows NT in different ways(application layer, kernel layer) so as to improve traditional mechanical drives as well as the performance of SSI).The article introduces the basic framework of ETW mechanism(Event Tracing for Windows);the implement principle of ETW technology; the application of ETW technology in monitoring the Read-and-write performance of physical disk; It also does analyze to the path of reading and writing data from application layer to driver layer under Windows NT,introduces the realization and distinguishing feature of driver HOOK technology in kernel; put forward the concrete implementation in monitoring Read-and-write performance of physical disk of driver HOOK technology;compares the merits and demerits of the two ways. In the end, the article will introduce the application prospect of the realization of Read-and-write performance of physical disk of driving mode.

Key words: LBA,Read-write operations, Event tracing for windows (ETW)，WMI, Driver HOOK technology, IRP request