Since the Hyper-V Replica engine is mathematically proving that hundreds of gigabytes of physical block-level writes are occurring on that virtual hard disk, an unseen process is rapidly altering the underlying data. When a file server experiences a sudden, massive spike in write operations without legitimate user activity, you must immediately investigate the possibility of a ransomware infection. Cryptographic malware systematically opens, encrypts, and overwrites existing files on the volume, which Hyper-V interprets as massive, continuous block modifications that will instantly bloat your replication tracking logs.
If you verify that your files are fully accessible and unencrypted, the next hidden culprits are native Windows file services that operate independently of your third-party backup software. Even with backups paused, Windows Server might still be running Shadow Copies for Shared Folders, a feature that automatically takes snapshots of the volume to provide users with the Previous Versions feature. If the hidden storage area dedicated to these shadow copies is churning, deleting old snaps, or dynamically resizing, it generates immense block-level traffic. Similarly, if this server participates in Distributed File System Replication, background staging tasks can silently rewrite gigabytes of data into hidden system folders.
To solve this mystery, you need to catch the responsible process in the act from within the ZDATA3 guest operating system. Open the Windows Run dialog and launch resmon.exe to access the Resource Monitor. Navigate directly to the Disk tab and expand the Processes with Disk Activity section. By sorting this list by the Write column, you will immediately expose the exact executable, whether it is a malicious payload, a runaway Windows service like the search indexer, or a hidden sync agent, that is generating this massive volume of writes and choking your replication queue.