29

My daughter had her thumb drive plugged into my desktop, doing some work. She finished, logged off of her account and I logged into mine. I noticed that she left her thumb drive in the USB port, and so I tried to safely eject it, but I get the following message:

Problem Ejecting USB Mass Storage Device

This device is currently in use. Close any programs or windows that might be using the device, and then try again.

OK, I give up. I just logged into my account and the first thing I did was try to eject her thumb drive. What in heck is currently using it? I don't have anything else opened/running when I got that message. How do I determine what program is apparently running and doing whatever it is, against that USB drive? How do I get whatever it is, to stop so I can safely disconnect the thing?

ﾤ ﾡ
  • 4,187
Rod
  • 1,646

7 Answers7

13

You can use Unlocker to find out what program has it opened, then close that program. If you cannot exit the program, you can use Unlocker to force the handle closed.

Unlocker showing processes with open handles


If it is Windows Explorer, you can restart it. En easy way is to hold Control + Shift and right-click a blank area in the Start menu:

Restarting Explorer in Windows 7

Marc.2377
  • 1,677
Synetech
  • 69,547
11

The key is to identify the process that has a directory open on the device you need to unmount (I've used the following on Windows 7).

  • A search for warning Event ID 225 from Kernel-PnP in Windows Logs / System log file should find a message of the form "(something) stopped the removal or ejection for the device (something)".

This is already explained in the post:

Access "Computer Management" (right-click "Computer" / "Manage")

System tools -> Event viewer -> Windows Logs -> System

Use 'Find' to search for the event ID.

  • You can also install Process Explorer to perform a search for the process or application:

Use that utility to search for a handle with the target drive letter (for example f: ), available under Find / Find handle or DLL ... That will help identify the offending process / PID, (similar to use of 'lsof' command under Linux), and the process can be stopped manually (e.g. using Task Manager or Process Explorer). You may need to run Process Explorer as Administrator if you are not the owner of the process.

I've found that some apps keep the directory open, even after a file has been saved and closed. Sometimes it is enough to open another file from your C: drive to reset the "current" directory for the app. Also, apps may still be running after the window has been closed. The searches above will help identify which app you need to stop.

Community
  • 1
asl_marc
  • 111
3

Another option that does not require third party tools:

  1. Open "Disk Management" (aka "Create and format hard disk partitions")
  2. Locate the disk you want to eject from the lower-left stack of Disks.
  3. Right-click the disk and choose "Offline".
  4. You can then attempt again as normal to "Eject Device" from the system tray, which should now succeed.

enter image description here

One disadvantage to this approach is when you plug in again, you may have to go through the process to put the disk into Online mode.

DuckMaestro
  • 1,834
2

You need to identify the process(es) which are using the drive. Run the following command in PowerShell:

Get-WinEvent -LogName 'System' | Where { $_.Id -Eq 225 }

It should show an entry with the message like below:

The application <executable_path> with process id <process_id> stopped the removal or ejection for the device <usb_device_id>.

Try exiting the app or stopping the process otherwise.

ﾤ ﾡ
  • 4,187
0

Microsoft has its own utility called Devcon.exe.

From the site:

DevCon (Devcon.exe), the Device Console, is a command-line tool that displays detailed information about devices on computers running Windows. You can use DevCon to enable, disable, install, configure, and remove devices.

DevCon runs on Microsoft Windows 2000 and later versions of Windows.

Community
  • 1
zundarz
  • 1,163
0

When you can trace processes which occupy drive there is no much problem (for example with mentioned earlier Unlocker small tool). However, sometimes this task is not so easy. There is no explicit handle bound with drive (Unlocker or Sysinternals handle or even process explorer won't show anything) but still Windows will not allow to unmount such drive. Advice like logout, restart or kill explorer seems a little exaggerated and hard to accept.

I have these issues mostly on HDD external drives than mere pendrives.

With pendrives you can use eject function from Windows Explorer drives list. When there is no explicit process then it will work.

With external HDDs there is much harder because there is no eject function. And if you check processes you won't find any handles tangled with drive. In reality, even if not shown there is one process which is blocking drive - system with PID number 4. You can trace it with event logger where system will write information that system process under PID 4 did block the operation. You can check if drive wasn't added to SystemRestore monitor (it's one of the reasons).

For other cases I am using simple script and tool USB_Disk_Eject from Quick And Easy Software.

The batch script is:

sync
net share %1$ /D
USB_Disk_Eject /REMOVELETTER %1

I was experimenting with one additional command

fsutil volume dismount %1

but it seems I didn't add it to main batch (not sure why).

Sync is a small Sysinternals tool which will force your drives to finalize write operations (from drive cache to drive).

I had only one case where above lines didn't work - it was AVG software and only logout help.

KrzysztofJ
  • 19
-1

Restart Windows Explorer

Task Manager(Ctrl+Shift+Esc)

  • tab Details > explorer.exe > button End task
  • File > New Task > explorer
Hideki
  • 1