45

Sometimes when I follow the process to safely remove a USB flash drive, I get told that I can't remove the drive because some programs are using it. However I'm unable to tell which programs these are, so I end up having to close programs - sometimes even randomly.

How do I find out which program is using my USB flash drive?

I've searched the Internet but have found nothing promising; one solution might be via Process Explorer since it shows handles, but I don't know how to use it to solve my problem.

The best solution would be to have a program that can automatically close these programs for me, or at least tell me which programs these are.

Improve this question
2
  • All we can say is Windows is using your flash drive. I think we've all seen this problem. There might be something in Device Manager which allows you to optimise the drive for quick removal. I can't check now ... I'm not using Windows at the moment.
    – pavium
    Commented Jun 13, 2011 at 13:59
  • I guess the reason for not showing which program locks it is, that it would be confusing if the program was some system driver ...
    – user712092
    Commented Jun 25, 2011 at 20:27

9 Answers 9

Reset to default
25

This tool and this tool both look like they would serve the purpose you are trying to achieve. The NirSoft interface is a little less direct, but I trust the author and his ability to write code. The second seems to have a more useful UI in your situation, but I have no history with the website or author.

ProcessExplorer is another easy way to do it, simply open up ProcessExplorer, hit Ctrl+F, and then type the name of the file. ProcessExplorer will list all the programs using that file. If the WhoLockMe tool doesn't work for you, I'd recommend ProcessExplorer next, simply because it has so many other useful features.

Improve this answer
8
  • 7
    I found it with ProcessExplorer. I just needed to type the few letters of path of my drive (which was for example "e:"). Thank You very much. :)
    – user712092
    Commented Jun 25, 2011 at 20:26
  • ProcessExplorer (apparently in difference with NirSoft's one) allows you to find folders being used, for example by a file system changes notifier utility, just <kbd>CTRL</kbd>+<kbd>F</kbd> and then type the letter of your thumb drive e.g. I:
    – Jaime Hablutzel
    Commented Mar 8, 2014 at 6:56
  • 2
    You need to run ProcessExlorer as Administator, if you want to search all processes, including system processes.
    – Alex Che
    Commented Sep 9, 2014 at 19:23
  • ProcessExplorer only works if the file is an executable: DLL or EXE.
    – Kaz
    Commented Jul 6, 2016 at 5:40
  • Apparently, as a test I opened a C# .sln file that was on a thumbdrive. It's not showing Visual Studio when I do a search for d:, the driveletter for my thumbdrive.
    – Eric
    Commented Aug 4, 2016 at 20:13
8

I use EjectUSB (working download link):

EjectUSB could be considered the nuclear option of USB drives that just won't properly eject in Windows, because there's an "application or process" accessing it. Put EjectUSB on your thumb drive and run it, and the program will mercilessly kill every program, process, or anything else touching your drive, letting you safely remove it without any fear of data loss.

Improve this answer
1
  • 6
    "the program will mercilessly kill every program, process, or anything else touching your drive, letting you safely remove it without any fear of data loss" The emphasized parts could mean a contradiction...
    – Sk8erPeter
    Commented Aug 31, 2014 at 17:25
5

In the Event Viewer (checked on windows 10) -> Windows Logs -> System - you can see what happened.

Example:

The application \Device\HarddiskVolume1\Program Files\Security\AVAST Software\Avast\AvastSvc.exe with process id 2080 stopped the removal or ejection for the device USB\VID_0BC2&PID_2300\2GH4ER2Z____.

Improve this answer
3
  • 1
    Happen to have an Event ID or Source to look for among a half-million log entries?
    – I say Reinstate Monica
    Commented Apr 13, 2017 at 14:41
  • you can look by time. It happens straight away, so if you happen to remove the USB drive and rejected - you go there and look by time. There are not much events occurring in few seconds, at least on my OS. Even more you can open the event viewer and refresh the view right after the operation
    – Genry
    Commented Apr 14, 2017 at 9:55
  • This is great because it doesn't require installing any new program
    – aditsu
    Commented Apr 16, 2017 at 9:53
4

In Windows 7 Pro, this works:

  1. Open "My Computer"
  2. Find the USB drive in question
  3. Right click on the USB drive
  4. Click on "eject"; you will now get the "...in use..." message - note that it has a "Continue" button!
  5. Click "Continue" to force the un-mount and you should be all set.

As per a prior answer, it's probably a good idea to make sure that the USB stick is set to be optimized for quick removal. That SHOULD ensure no open writes.... ymmv

Improve this answer
1
  • 2
    No such context menu command in Windows 7: no Eject.
    – Kaz
    Commented Jul 6, 2016 at 5:41
2

@Darth Android's solution also works with Process Hacker

  1. Ctrl+F
  2. Enter Drive letter, eg. E:
  3. Bam! A list of programs invading your device
Improve this answer
3
  • Please read How do I recommend software for some tips as to how you should go about recommending software.
    – DavidPostill ♦
    Commented Aug 6, 2015 at 21:29
  • Process Explorer is useful for this too. Thanks
    – Metafaniel
    Commented Sep 23, 2015 at 17:00
  • Doesn't work. Search for M: comes up with nothing, just like in Process Explorer. This appears to be a freeware clone of Process Explorer.
    – Kaz
    Commented Jul 6, 2016 at 5:46
1

ProcMon by Sysinternals would allow you to watch all file and registry activity and allows you to filter only those entries referencing your thumbdrive. This may be a more thorough way to telling each and every process that is using your drive.

Also, depending on your Windows version, there may be default apps using the drive.

If Win7, check if SuperFetch is enabled on your USB thumb drives. If XP, check if disk write caching is enabled.

SuperFetch allows windows to use temporary storage as additional "RAM", moving the disk cache off the system drive. Disk write caching allows file transfers to and from removable disks to appear to go faster by actually occuring in the background and during system idle times.

Improve this answer
1

I see this randomly on NTFS-formatted external drives (both HD and Flash). Even when they are set to "Optimize for Quick Removal" in Device Manager, something in the system (probably the filesystem driver) is holding onto something that it shouldn't. No tool I've found is able to even display what resource is being held, and Process Explorer doesn't show any open handles to the device or any of its files.

The only recourse I've found is either shutting down the system or using Sysinternal's sync tool to flush all the filesystem buffers and just yank the cord. When I do a "dirty" pull, I'll immediately reattach, run chkdsk, and be able to eject the drive normally afterwards.

Improve this answer
1

After trying many tools i settled for Unlocker which helps in the scenarios where Windows complains about locked files etc. You can get it at http://www.filehippo.com/download_unlocker/. While nirsoft utility and Process Explorer work, i think they are meant for advanced users. For a quick get out if the way solution Unlocker works.

Improve this answer
4
  • using unlocker for a removable is not advised as you might corrupt the FS and the data inside it.
    – Lorenzo Von Matterhorn
    Commented Dec 5, 2013 at 0:29
  • @LorenzoVonMatterhorn: why would it corrupt the filesystem and the data inside it?
    – Sk8erPeter
    Commented Aug 28, 2014 at 17:38
  • @Sk8erPeter how corruption happens is discussed for example here superuser.com/questions/594974/…
    – user712092
    Commented Dec 29, 2016 at 14:09
  • @user712092: I know some possibilities about filesystem corruption, I just wanted to know how Unlocker potentially works in this case - but I guess Lorenzo suggests that it may break the process of "safely" removing the hardware, because it does not indicate to the OS that the writing cache should be flushed to the drive.
    – Sk8erPeter
    Commented Dec 31, 2016 at 12:24
0

I solved my problem by setting the drive offine like this:

  1. Goto "This PC" -> "Manage" -> "Disk Management"
  2. Right-click the disk icon in the partition map below
  3. Click "Offline"

The disk in the partition map should now be gone. You should be able to safely remove the drive without errors.

Don't forget to set it online next time after you connect your drive.

Improve this answer
1
  • 1
    this is disconnecting the drive by brute force, the action itself is not safe
    – im_chc
    Commented Feb 14, 2018 at 0:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .