Which programs are using my USB flash drive?

Sometimes when I follow the process to safely remove a USB flash drive, I get told that I can't remove the drive because some programs are using it. However I'm unable to tell which programs these are, so I end up having to close programs - sometimes even randomly.

How do I find out which program is using my USB flash drive?

I've searched the Internet but have found nothing promising; one solution might be via Process Explorer since it shows handles, but I don't know how to use it to solve my problem.

The best solution would be to have a program that can automatically close these programs for me, or at least tell me which programs these are.

user712092

Posted 2011-06-13T13:53:55.770

Reputation: 687

All we can say is Windows is using your flash drive. I think we've all seen this problem. There might be something in Device Manager which allows you to optimise the drive for quick removal. I can't check now ... I'm not using Windows at the moment. – pavium – 2011-06-13T13:59:27.430

I guess the reason for not showing which program locks it is, that it would be confusing if the program was some system driver ... – user712092 – 2011-06-25T20:27:52.710

Answers

This tool and this tool both look like they would serve the purpose you are trying to achieve. The NirSoft interface is a little less direct, but I trust the author and his ability to write code. The second seems to have a more useful UI in your situation, but I have no history with the website or author.

ProcessExplorer is another easy way to do it, simply open up ProcessExplorer, hit Ctrl+F, and then type the name of the file. ProcessExplorer will list all the programs using that file. If the WhoLockMe tool doesn't work for you, I'd recommend ProcessExplorer next, simply because it has so many other useful features.

Darth Android

Posted 2011-06-13T13:53:55.770

Reputation: 35 133

2You need to run ProcessExlorer as Administator, if you want to search all processes, including system processes. – Alex Che – 2014-09-09T19:23:18.253

ProcessExplorer only works if the file is an executable: DLL or EXE. – Kaz – 2016-07-06T05:40:10.493

Apparently, as a test I opened a C# .sln file that was on a thumbdrive. It's not showing Visual Studio when I do a search for d:, the driveletter for my thumbdrive. – Eric – 2016-08-04T20:13:21.487

@Eric Then that file is no longer open. Most likely, VisualStudio opened it, read it, and then closed it. – Darth Android – 2016-08-08T14:09:14.097

Nope, I got the error when I tried to eject the USB drive with the C# sln file open. Because the .sln file wasn't an executable ProcessExplorer didn't show it. The nirsoft tools did show it. – Eric – 2016-08-09T10:56:54.397

Process Explorer searches DLLs and handles. Opened files are included in the latter group. Visual Studio does not keep any files open. Instead, it watches the folders for changes. So yes, Process Explorer definitely does the job. – Daniel B – 2017-08-14T15:18:34.280

7I found it with ProcessExplorer. I just needed to type the few letters of path of my drive (which was for example "e:"). Thank You very much. :) – user712092 – 2011-06-25T20:26:14.347

ProcessExplorer (apparently in difference with NirSoft's one) allows you to find folders being used, for example by a file system changes notifier utility, just <kbd>CTRL</kbd>+<kbd>F</kbd> and then type the letter of your thumb drive e.g. I: – Jaime Hablutzel – 2014-03-08T06:56:21.077

I use EjectUSB (working download link):

EjectUSB could be considered the nuclear option of USB drives that just won't properly eject in Windows, because there's an "application or process" accessing it. Put EjectUSB on your thumb drive and run it, and the program will mercilessly kill every program, process, or anything else touching your drive, letting you safely remove it without any fear of data loss.

Leftium

Posted 2011-06-13T13:53:55.770

Reputation: 8 163

5"the program will mercilessly kill every program, process, or anything else touching your drive, letting you safely remove it without any fear of data loss" The emphasized parts could mean a contradiction... – Sk8erPeter – 2014-08-31T17:25:11.173

In the Event Viewer (checked on windows 10) -> Windows Logs -> System - you can see what happened.

Example:

The application \Device\HarddiskVolume1\Program Files\Security\AVAST Software\Avast\AvastSvc.exe with process id 2080 stopped the removal or ejection for the device USB\VID_0BC2&PID_2300\2GH4ER2Z____.

Genry

Posted 2011-06-13T13:53:55.770

Reputation: 141

1Happen to have an Event ID or Source to look for among a half-million log entries? – I say Reinstate Monica – 2017-04-13T14:41:28.730

you can look by time. It happens straight away, so if you happen to remove the USB drive and rejected - you go there and look by time. There are not much events occurring in few seconds, at least on my OS. Even more you can open the event viewer and refresh the view right after the operation – Genry – 2017-04-14T09:55:13.670

This is great because it doesn't require installing any new program – aditsu – 2017-04-16T09:53:01.633

In Windows 7 Pro, this works:

Open "My Computer"
Find the USB drive in question
Right click on the USB drive
Click on "eject"; you will now get the "...in use..." message - note that it has a "Continue" button!
Click "Continue" to force the un-mount and you should be all set.

As per a prior answer, it's probably a good idea to make sure that the USB stick is set to be optimized for quick removal. That SHOULD ensure no open writes.... ymmv

Neradullmoment

Posted 2011-06-13T13:53:55.770

Reputation: 41

1No such context menu command in Windows 7: no Eject. – Kaz – 2016-07-06T05:41:57.673

@Darth Android's solution also works with Process Hacker

Ctrl+F
Enter Drive letter, eg. E:
Bam! A list of programs invading your device

user3826642

Posted 2011-06-13T13:53:55.770

Reputation: 131

Please read How do I recommend software for some tips as to how you should go about recommending software.

– DavidPostill – 2015-08-06T21:29:47.277

Process Explorer is useful for this too. Thanks – Metafaniel – 2015-09-23T17:00:39.130

Doesn't work. Search for M: comes up with nothing, just like in Process Explorer. This appears to be a freeware clone of Process Explorer. – Kaz – 2016-07-06T05:46:13.667

ProcMon by Sysinternals would allow you to watch all file and registry activity and allows you to filter only those entries referencing your thumbdrive. This may be a more thorough way to telling each and every process that is using your drive.

Also, depending on your Windows version, there may be default apps using the drive.

If Win7, check if SuperFetch is enabled on your USB thumb drives. If XP, check if disk write caching is enabled.

SuperFetch allows windows to use temporary storage as additional "RAM", moving the disk cache off the system drive. Disk write caching allows file transfers to and from removable disks to appear to go faster by actually occuring in the background and during system idle times.

music2myear

Posted 2011-06-13T13:53:55.770

Reputation: 34 957

I see this randomly on NTFS-formatted external drives (both HD and Flash). Even when they are set to "Optimize for Quick Removal" in Device Manager, something in the system (probably the filesystem driver) is holding onto something that it shouldn't. No tool I've found is able to even display what resource is being held, and Process Explorer doesn't show any open handles to the device or any of its files.

The only recourse I've found is either shutting down the system or using Sysinternal's sync tool to flush all the filesystem buffers and just yank the cord. When I do a "dirty" pull, I'll immediately reattach, run chkdsk, and be able to eject the drive normally afterwards.

afrazier

Posted 2011-06-13T13:53:55.770

Reputation: 21 316

After trying many tools i settled for Unlocker which helps in the scenarios where Windows complains about locked files etc. You can get it at http://www.filehippo.com/download_unlocker/. While nirsoft utility and Process Explorer work, i think they are meant for advanced users. For a quick get out if the way solution Unlocker works.

Dinesh Manne

Posted 2011-06-13T13:53:55.770

Reputation: 1 079

@LorenzoVonMatterhorn: why would it corrupt the filesystem and the data inside it? – Sk8erPeter – 2014-08-28T17:38:06.083

@Sk8erPeter how corruption happens is discussed for example here http://superuser.com/questions/594974/usb-stick-how-to-minimize-risk-of-data-corruption-or-data-loss

– user712092 – 2016-12-29T14:09:12.817

@user712092: I know some possibilities about filesystem corruption, I just wanted to know how Unlocker potentially works in this case - but I guess Lorenzo suggests that it may break the process of "safely" removing the hardware, because it does not indicate to the OS that the writing cache should be flushed to the drive. – Sk8erPeter – 2016-12-31T12:24:33.930

using unlocker for a removable is not advised as you might corrupt the FS and the data inside it. – Lorenzo Von Matterhorn – 2013-12-05T00:29:47.863

I solved my problem by setting the drive offine like this:

Goto "This PC" -> "Manage" -> "Disk Management"
Right-click the disk icon in the partition map below
Click "Offline"

The disk in the partition map should now be gone. You should be able to safely remove the drive without errors.

Don't forget to set it online next time after you connect your drive.

random_guy_a

Posted 2011-06-13T13:53:55.770

Reputation: 1

1this is disconnecting the drive by brute force, the action itself is not safe – im_chc – 2018-02-14T00:15:36.270