After working with an external USB backup disk I want to cleanly unmount the drive. When pressing the 'eject' button Finder warns me with the message:

  • "The volume can't be ejected because it's currently in use."


  • "The disk "Diskname" wasn't ejected because one or more programs may be using it.".

or when trying to use the Terminal: umount /Volumes/Diskname

  • "umount(/Volumes/Diskname): Resource busy -- try 'diskutil unmount'"

As far as I am aware, I am not using this disk but Finder says I do, so I must be wrong. I prefer a clean unmount of the drive. As I am in the middle of doing multiple tasks, logging out and logging in is not preferred as is the installation of third party software.

Terminal command lsof might be of use here, but personally I think this is too complex for such a 'simple' problem and to be honest, I do not know how to use it properly.

My question: How do I know what program is using my drive so I can properly quit that program and eject my drive?

The volume can't be ejected because it's currently in use. The disk "Camel" wasn't ejected because one or more programs may be using it. The disk "Mammtoh" wasn't ejected because one or more programs... xkcd


10 Answers 10


lsof is indeed your best bet. The fastest and easiest way would be this :-

sudo lsof /Volumes/myDrive

(be sure to run with sudo otherwise it probably won't work as intended)

It can take a couple minutes to run, but once it's complete, it gives you a list of open files on the disk. The output will look something like this:

mds         89  root   19r   DIR   52,3      432     2 /Volumes/Photos
mds         89  root   23r   DIR   52,3      432     2 /Volumes/Photos
Finder     681 alans   14r   DIR   52,3      432     2 /Volumes/Photos
QuickLook 2158 alans    9r   REG   52,3  1141591 78651 /Volumes/Photos/_tmp_iphone_10_backup/APC_1546.JPG  

In this case, it's the QuickLook application that has a file open. Closing the application directly is the best way to fix the issue. However, that's not always possible. For example, QuickLook doesn't show up as an application you can get to in the Dock.

If you can't close the application manually, you can use the kill command to terminate it from the command line. To do that, use the PID from the second column as the ID to kill. From the above example, it would be:

kill 2158

Note that sometimes that doesn't work and a more aggressive form of kill must be used. Here's a series of escalating aggressiveness (using the example PID of 2158):

kill 2158
sudo kill 2158
sudo kill -INT 2158
sudo kill -KILL 2158

You should be able to eject the disk once the process/application has been killed.

One final note, lsof can take a minute or two. It can also hang, but you should give it at least a few minutes before you decide that's what happened.

Also, sometimes the base command sudo lsof /Volumes/myDrive won't find anything. If that happens, try adding the +D argument (i.e. sudo lsof +D /Volumes/myDrive). That will do a top down scan of the disk. It'll take longer, but it should pick up anything that's causing the disk to be un-ejectable.

(Hat tip to Alec Jacobson's post for extra details.)

  • 2
    I found this as well, but I hoped someone has a non terminal solution. If not, you'll get your plus one ;) Commented Oct 10, 2013 at 10:50
  • 32
  • 5
    → Paul: I'd suggest you to improve your suggested command as: /usr/bin/sudo lsof /Volumes/myDrive
    – dan
    Commented Aug 26, 2014 at 11:11
  • 3
    Oh excellent, I did lsof without sudo which gives a totally different set of results.
    – Alper
    Commented Nov 10, 2015 at 14:14
  • 3
    Yep, sudo is definitely needed in a lot of cases. In my case this revealed that it was due to Spotlight trying to index the disk, so the solution was to disable Spotlight for the disk, then manually stop/restart Spotlight.
    – Tom
    Commented Jan 20, 2016 at 14:28

Have you tried $ diskutil unmount /Volumes/Diskname ?

Or $ diskutil unmount force /Volumes/Diskname ?

As the manpage points out:

Due to the complex and interwoven nature of Mac OS X, umount may fail often. It is recommended that diskutil(1) (as in, "diskutil unmount /mnt") be used instead.

If your volume has spaces in the name, be sure to escape the spaces with \, eg:

$ diskutil unmount /Volumes/Disk\ Name

Or use quotes to avoid confusion.

$ diskutil unmount "/Volumes/Disk Name"
  • 1
    I believe I tried this and it did not work. But next time I'll try it again and update my post accordingly. Commented May 1, 2014 at 8:30
  • Your example has quotes, not apostrophes. Which is a good thing. Commented Aug 18, 2014 at 15:14
  • 1
    @NicolasBarbulesco: Thanks for pointing that out, I made corrections to the answer. Good catch! Commented Aug 26, 2014 at 13:52
  • 2
    Worked -> sudo diskutil unmount force /Volumes/Diskname
    – tgkprog
    Commented Mar 28, 2015 at 6:43
  • 1
    @tgkprog Glad to hear it, also thanks for the sudo command, that may help others as well. Commented Mar 30, 2015 at 16:02

Your problem is probably caused by the process mds : Spotlight indexing your disk.

I have this problem, and I have not found a solution (yet).

  • 1
    This is how to disable/re-enable spotlight indexing: iclarified.com/49187/… Commented Nov 16, 2017 at 20:50
  • 1
    I also found that mds service using it. I tried to disable the mds service for flash drive using "sudo mdutil -i off /Volumes/16GB" but it also did not helped. I had to relaunch the Finder using "Option+Click" on FInder.
    – Aruna
    Commented May 19, 2018 at 2:27

You could try the donationware application "What's Keeping me?" that shows what process/application is using the volume/folder/file.

This program is certified by the developer for Mac OS X 10.6 Snow Leopard, but the RoaringApps page for this application lists it as working fine on OS X 10.7 Lion and OS X 10.8 Mountain Lion.

About What's Keeping Me?

Have you ever have the problem where you can’t empty the Trash or eject a disk because something is preventing you? Usually the reason is because some application has a file open, and thus you can’t get rid of the disk or trash the file. That’s why we made What’s Keeping Me! What’s Keeping Me will identify the application that is holding the item open. You can then use What's Keeping Me to quit the problem application (or kill it if needed) so you can perform your task. What’s Keeping Me includes an Automator workflow so you can perform searches directly from the Finder too!

  • 1
    This looks like valid software, but I really prefer OS X native solutions. Commented Oct 10, 2013 at 17:05
  • By native you mean something Apple provides? There's nothing like that on the GUI front. Plus, WKM has been around for several years.
    – M K
    Commented Oct 10, 2013 at 20:24
  • Thanks for your addition. Native is not the correct word, what I meant was 'non-third party'. WKM is a nice solution, but personally I prefer lsof. Commented Oct 14, 2013 at 7:56
  • Just tested the app in High Sierra and it still works. It's also 64-bit. Commented Feb 13, 2018 at 21:44
  • Links are dead. Commented Jul 20, 2022 at 21:30

Try to relaunch the Finder. Here it works

  • Not sure why this was downvoted; In my case, QuickLook and mds both had a hold on it (despite no active finder windows open). I could restart mds, but qlmanage -r said it was "resetting quicklookd" but it still held the file open according to lsof +D /path/to/volume. A relaunch of the finder cleared it up and I was able to eject the volume. Commented Aug 16, 2018 at 1:52

I've had this message despite being sure there are no open files on the volume. I checked this with Why Not Unmount, a GUI tool that can indicate open files on a disk.

In my case, it was a sign that the file system is corrupt. Running Disk Utility (or if that wasn't enough, DiskWarrior) solved the problem and made the disk ejectable again.

  • 1
    In my case, the system was not corrupt. Commented Apr 8, 2014 at 11:14
  • Seems unlikely. More likely Spotlight, or some other app or service has a lock on the disk.
    – Tom
    Commented Jan 20, 2016 at 14:33
  • Link is dead now Commented Jul 20, 2022 at 21:31

NOTE: fseventer works until OS X 10.10 Yosemite and the developer's page http://www.fernlightning.com meanwhile got offline. Hence the product links were removed. With brew cask install fseventer it may still be available on elder macOS versions.

There is a GUI alternative to the CLI app lsof:
fseventer is a great file system access monitoring utility for various purposes. It runs with super user permissions (sudo), so it sees all read/write access of all mounted file systems, and presents them in a very clear overview.

My experience: I had a Volume which constantly could not be ejected properly (as in the OP's screenshots), and always needed a "force eject", sometimes even a forceful physical disconnection (nor recommended! could damage your filesystem(s) on that disk) or a system shutdown to bypass that brute method.

My fix: Summarized: The ejection issue can be caused by corrupted or legacy file content on that Volume. Removing the troubled content can fix this permanently. In detail:

  1. Determine which file is accessed (with lsof or fseventer). In my case it was a Classic Mac OS file with a resource fork that remained open, likely as some background disk parsing process (Spotlight, QuickLook, or thelike) hung on it.

  2. Backup that troubling data into a file archive (which preserves (Classic) Mac specific resource data). I simply used Finder's native "Compress" function from it's context menu.

  3. Delete the troubled file/folder.

    • With Finder as usual. Likely this will fail, as it's a "troubled file/folder".
    • With Finder plus holding down ALT while emptying the Trash. This creates a little more force, but likely it will still fail.
    • Through the Terminal with sudo rm -R /path/to/troublesome/FileOrFolder. This eventually worked after Finder's delete attempts have failed.
  4. Try unmounting the volume again. It may still fail, as the background processes, which failed, could be still in a irrecoverable state.

  5. Restart. Then try unmounting again. From then forth the Volume worked fine again. Normal mounting, unmounting, read/write operations. Only when a file was indeed open by a user process, unmounting was prevented. Perfectly normal behaviour again.


Both the command line solution and What's Keeping Me work great.

To recap, command line in terminal is:

sudo lsof | grep /Volumes/myDrive

The GUI application is What's Keeping Me, ~~available at Hamsoft Engineering]~~ Thomas Templeman1.

Screenshots of both with the same search going on.

Command line output GUI for What's Keeping Me

I prefer the command line just slightly, as it's always there with you. On the other hand, What's Keeping Me is quicker and easier to use if you've got it installed.


Solution Make sure all programs are closed. Click the Apple icon in the top left of the screen, then click Force Quit. In the list click Finder. Now click the Relaunch button. Then try ejecting the drive again.

  • Did you see this solution work? Commented Aug 16, 2015 at 11:45
  • Or a simpler way… Use the sudo lsof… method described in the accepted solution, find the application that's causing the trouble, then close that specific application. Commented Sep 17, 2021 at 19:22

I restarted my Mac and that fixed it :-)

  • 2
    I prefer a clean unmount of the drive. As I am in the middle of doing multiple tasks, logging out and logging in is not preferred as is the installation of third party software. Commented Jul 24, 2014 at 6:44
  • Thanks for a big tech helpline answer and a laugh. You should work for Microsoft customer support! Commented Jun 30, 2022 at 18:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .