100

After working with an external USB backup disk I want to cleanly unmount the drive. When pressing the 'eject' button Finder warns me with the message:

  • "The volume can't be ejected because it's currently in use."

or

  • "The disk "Diskname" wasn't ejected because one or more programs may be using it.".

or when trying to use the Terminal: umount /Volumes/Diskname

  • "umount(/Volumes/Diskname): Resource busy -- try 'diskutil unmount'"

As far as I am aware, I am not using this disk but Finder says I do, so I must be wrong. I prefer a clean unmount of the drive. As I am in the middle of doing multiple tasks, logging out and logging in is not preferred as is the installation of third party software.

Terminal command lsof might be of use here, but personally I think this is too complex for such a 'simple' problem and to be honest, I do not know how to use it properly.

My question: How do I know what program is using my drive so I can properly quit that program and eject my drive?

The volume can't be ejected because it's currently in use. The disk "Camel" wasn't ejected because one or more programs may be using it. The disk "Mammtoh" wasn't ejected because one or more programs... xkcd

10 Answers 10

129

lsof is indeed your best bet. The fastest and easiest way would be this :-

sudo lsof /Volumes/myDrive

It can take a couple minutes to run, but once it's complete, it gives you a list of open files on the disk. The output will look something like this:

COMMAND    PID  USER   FD   TYPE DEVICE SIZE/OFF  NODE NAME
mds         89  root   19r   DIR   52,3      432     2 /Volumes/Photos
mds         89  root   23r   DIR   52,3      432     2 /Volumes/Photos
Finder     681 alans   14r   DIR   52,3      432     2 /Volumes/Photos
QuickLook 2158 alans    9r   REG   52,3  1141591 78651 /Volumes/Photos/_tmp_iphone_10_backup/APC_1546.JPG  

In this case, it's the QuickLook application that has a file open. Closing the application directly is the best way to fix the issue. However, that's not always possible. For example, QuickLook doesn't show up as an application you can get to in the Dock.

If you can't close the application manually, you can use the kill command to terminate it from the command line. To do that, use the PID from the second column as the ID to kill. From the above example, it would be:

kill 2158

Note that sometimes that doesn't work and a more aggressive form of kill must be used. Here's a series of escalating aggressiveness (using the example PID of 2158):

kill 2158
sudo kill 2158
sudo kill -INT 2158
sudo kill -KILL 2158

You should be able to eject the disk once the process/application has been killed.

One final note, lsof can take a minute or two. It can also hang, but you should give it at least a few minutes before you decide that's what happened.

Also, sometimes the base command sudo lsof /Volumes/myDrive won't find anything. If that happens, try adding the +D argument (i.e. sudo lsof +D /Volumes/myDrive). That will do a top down scan of the disk. It'll take longer, but it should pick up anything that's causing the disk to be un-ejectable.

(Hat tip to Alec Jacobson's post for extra details.)

  • 1
    I found this as well, but I hoped someone has a non terminal solution. If not, you'll get your plus one ;) – CousinCocaine Oct 10 '13 at 10:50
  • 27
  • 3
    → Paul: I'd suggest you to improve your suggested command as: /usr/bin/sudo lsof /Volumes/myDrive – dan Aug 26 '14 at 11:11
  • 3
    Oh excellent, I did lsof without sudo which gives a totally different set of results. – Alper Nov 10 '15 at 14:14
  • 2
    Yep, sudo is definitely needed in a lot of cases. In my case this revealed that it was due to Spotlight trying to index the disk, so the solution was to disable Spotlight for the disk, then manually stop/restart Spotlight. – Tom Jan 20 '16 at 14:28
30

Have you tried $ diskutil unmount /Volumes/Diskname ?

Or $ diskutil unmount force /Volumes/Diskname ?

As the manpage points out:

Due to the complex and interwoven nature of Mac OS X, umount may fail often. It is recommended that diskutil(1) (as in, "diskutil unmount /mnt") be used instead.

If your volume has spaces in the name, be sure to escape the spaces with \, eg:

$ diskutil unmount /Volumes/Disk\ Name

Or use quotes to avoid confusion.

$ diskutil unmount "/Volumes/Disk Name"
  • 1
    I believe I tried this and it did not work. But next time I'll try it again and update my post accordingly. – CousinCocaine May 1 '14 at 8:30
  • Your example has quotes, not apostrophes. Which is a good thing. – Nicolas Barbulesco Aug 18 '14 at 15:14
  • 1
    @NicolasBarbulesco: Thanks for pointing that out, I made corrections to the answer. Good catch! – Jason Robinson Aug 26 '14 at 13:52
  • 1
    Worked -> sudo diskutil unmount force /Volumes/Diskname – tgkprog Mar 28 '15 at 6:43
  • 1
    @tgkprog Glad to hear it, also thanks for the sudo command, that may help others as well. – Jason Robinson Mar 30 '15 at 16:02
15

Your problem is probably caused by the process mds : Spotlight indexing your disk.

I have this problem, and I have not found a solution (yet).

  • This is how to disable/re-enable spotlight indexing: iclarified.com/49187/… – rstackhouse Nov 16 '17 at 20:50
  • I also found that mds service using it. I tried to disable the mds service for flash drive using "sudo mdutil -i off /Volumes/16GB" but it also did not helped. I had to relaunch the Finder using "Option+Click" on FInder. – Aruna May 19 '18 at 2:27
6

You could try the donationware application "What's Keeping me?" that shows what process/application is using the volume/folder/file.

This program is certified by the developer for Mac OS X 10.6 Snow Leopard, but the RoaringApps page for this application lists it as working fine on OS X 10.7 Lion and OS X 10.8 Mountain Lion.

About What's Keeping Me?

Have you ever have the problem where you can’t empty the Trash or eject a disk because something is preventing you? Usually the reason is because some application has a file open, and thus you can’t get rid of the disk or trash the file. That’s why we made What’s Keeping Me! What’s Keeping Me will identify the application that is holding the item open. You can then use What's Keeping Me to quit the problem application (or kill it if needed) so you can perform your task. What’s Keeping Me includes an Automator workflow so you can perform searches directly from the Finder too!

  • 1
    This looks like valid software, but I really prefer OS X native solutions. – CousinCocaine Oct 10 '13 at 17:05
  • By native you mean something Apple provides? There's nothing like that on the GUI front. Plus, WKM has been around for several years. – M K Oct 10 '13 at 20:24
  • Thanks for your addition. Native is not the correct word, what I meant was 'non-third party'. WKM is a nice solution, but personally I prefer lsof. – CousinCocaine Oct 14 '13 at 7:56
  • Just tested the app in High Sierra and it still works. It's also 64-bit. – dianeoforegon Feb 13 '18 at 21:44
4

I've had this message despite being sure there are no open files on the volume. I checked this with Why Not Unmount, a GUI tool that can indicate open files on a disk.

In my case, it was a sign that the file system is corrupt. Running Disk Utility (or if that wasn't enough, DiskWarrior) solved the problem and made the disk ejectable again.

  • 1
    In my case, the system was not corrupt. – CousinCocaine Apr 8 '14 at 11:14
  • Seems unlikely. More likely Spotlight, or some other app or service has a lock on the disk. – Tom Jan 20 '16 at 14:33
3

Both the command line solution and What's Keeping Me work great.

To recap, command line in terminal is:

lsof | grep /Volumes/myDrive

The GUI application is What's Keeping Me, available at Hamsoft Engineering.

Screenshots of both with the same search going on.

Command line output GUI for What's Keeping Me

I prefer the command line just slightly, as it's always there with you. On the other hand, What's Keeping Me is quicker and easier to use if you've got it installed.

3

NOTE: fseventer works until OS X 10.10 Yosemite and the developer's page http://www.fernlightning.com meanwhile got offline. Hence the product links were removed. With brew cask install fseventer it may still be available on elder macOS versions.

There is a GUI alternative to the CLI app lsof:
fseventer is a great file system access monitoring utility for various purposes. It runs with super user permissions (sudo), so it sees all read/write access of all mounted file systems, and presents them in a very clear overview.

My experience: I had a Volume which constantly could not be ejected properly (as in the OP's screenshots), and always needed a "force eject", sometimes even a forceful physical disconnection (nor recommended! could damage your filesystem(s) on that disk) or a system shutdown to bypass that brute method.

My fix: Summarized: The ejection issue can be caused by corrupted or legacy file content on that Volume. Removing the troubled content can fix this permanently. In detail:

  1. Determine which file is accessed (with lsof or fseventer). In my case it was a Classic Mac OS file with a resource fork that remained open, likely as some background disk parsing process (Spotlight, QuickLook, or thelike) hung on it.

  2. Backup that troubling data into a file archive (which preserves (Classic) Mac specific resource data). I simply used Finder's native "Compress" function from it's context menu.

  3. Delete the troubled file/folder.

    • With Finder as usual. Likely this will fail, as it's a "troubled file/folder".
    • With Finder plus holding down ALT while emptying the Trash. This creates a little more force, but likely it will still fail.
    • Through the Terminal with sudo rm -R /path/to/troublesome/FileOrFolder. This eventually worked after Finder's delete attempts have failed.
  4. Try unmounting the volume again. It may still fail, as the background processes, which failed, could be still in a irrecoverable state.

  5. Restart. Then try unmounting again. From then forth the Volume worked fine again. Normal mounting, unmounting, read/write operations. Only when a file was indeed open by a user process, unmounting was prevented. Perfectly normal behaviour again.

1

Solution Make sure all programs are closed. Click the Apple icon in the top left of the screen, then click Force Quit. In the list click Finder. Now click the Relaunch button. Then try ejecting the drive again.

1

Try to relaunch the Finder. Here it works

  • Not sure why this was downvoted; In my case, QuickLook and mds both had a hold on it (despite no active finder windows open). I could restart mds, but qlmanage -r said it was "resetting quicklookd" but it still held the file open according to lsof +D /path/to/volume. A relaunch of the finder cleared it up and I was able to eject the volume. – AC Capehart Aug 16 '18 at 1:52
-2

I restarted my Mac and that fixed it :-)

  • 1
    I prefer a clean unmount of the drive. As I am in the middle of doing multiple tasks, logging out and logging in is not preferred as is the installation of third party software. – CousinCocaine Jul 24 '14 at 6:44

You must log in to answer this question.

protected by Community Sep 29 '16 at 7:20

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged .