Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have an external HDD which I would like to "safely remove". Unfortunately, my system (Windows 7 x64) complains that "the device is currently in use".

Using Process Explorer I discovered which process is holding a handle on the device:

Process Explorer Screenshot

Obviously, System is not a process that I can just kill and be done with it. I've done a bit of research and this seems to be a common problem, but no solution has been found so far (except for rebooting the machine, which I'd like to avoid if possible).

Is there any solution to this problem that I've missed?

share|improve this question
haha yeah. rebooting may fix the problem but reboot suks. – apis17 Feb 19 '14 at 10:51

3 Answers 3

up vote 11 down vote accepted

I've always had this problem with one of my Toshiba external drives. I value that drive really high because of its built-in shock detector, what is currently very hard to find. But the cannot-remove-it-safely issue was driving me crazy.

Today, I've hit this question/thread on social-technet MS site. While there's a lot of noise down there, they point out a few common issues. Like the Distributed-Tracking service. It's actually hard to read through it all due to some cohones-size-flame-war that escalated at some point, but reading the topic from its end helps;)

Anyways, sorry for my chatty mood, I've just fixed my case permanently.

I've got any Distributed-Tracking/Windows-Search/etc services off and was still unable to safely-unplug the drive. Someone somewhere suggested that "quick removal" is the culprit, but almost all my USB drives run on it and I still can remove them safely.

However, I actually tried switching this drive to "high performance mode" and .. it caused the TxfLogContainerXXXX handles to evaporate. So, it's true that this is the quick-removal option. However, this did not released my drive yet. Still couldn't eject it.

Then I have went to ComputerManagement->DriveManagement utility and I have removed any drive-letter assignements for that drive. Instantly afterwards, I was able to eject the drive.

Then I tried connecting it again, reassigning the drive letter, switching it to quick-removal and it seems to work properly and still be ejectable.

On the so-long topic on MS site, they also mention these actions. Someone suggested to:

  • change drive letters and reboot
  • or, try turning the drive "offline"

I think that the "turn the drive offline" via "computer management -> drive management" might actually be the quickest solution, however I have not tried it since my random attempts helped before I've read about that.

share|improve this answer
I had the same problem (caused by the same lock on \$Extend\$RmMetadata\$Txf), but in my case I was unable to dismount a TrueCrypt drive. I use Voidtools Everything and that process turned out to hold the lock. Solution: kill Everything before dismounting or make sure to have the drive mounted as a "removable medium" in the TrueCrypt settings. Files on that drive will then not be indexed by Everything. – mgr326639 Sep 11 at 12:33
On Windows 8.1, I was able to change the drive letter, and then just eject the new drive letter from the system tray. Thanks. – Adrian Nov 5 at 14:07

If your disk is set for quick removal (in drive policies) you should be able to safely unplug it without using the "safely remove" option.

I had the same error as Heinzi, but when I tried to solve it by changing the mode to "better performance", I noticed what the default option actually does :)

It sounds dangerous but perhaps without caching there really should be no worries?

BTW, my drive is a WD-500 and in drive management there is no option to turn drive offline.

share|improve this answer
The only worry is if some application decides to write to the disk at the time you eject it. Unless you know for sure that the process that has the handle to that drive is actually not going to write to the drive, it is a little risky. YMMV. – Adrian Nov 5 at 14:09

I assume you are using a fully patched windows 7 Operating System.

Check the properties in Disk Management on the drive to be sure it is set for "Quick Removal" (Policies Tab)

See this page for a 3 step process to help troubleshoot the problem. This is a process of booting into safe mode, see if the problem persists, if it does not happen in safe mode, perform a Clean boot, see if the problem persists, this is a process of elimination of software and drivers.

This is can be a motherboard chipset driver issue, a firmware issue for the external drive enclosure, or installed 3rd party software, which may not be easy to solve.

Some find that disabling the "Distributed Link Tracking Client" Windows service solves it, there are no clear answers.

What you can try is to back up the data on that drive to another location, do a long format of the drive, copy the data back.

share|improve this answer
your intent is to be helpful, but every one of your suggestions is wrong i.e. logically faulty. You're not addressing the problem but making it worse for someone gullible person who might read it and follow it as if you were a knowledgeable authority. The reference to a MS guy's post is funny because he is also wrong. The only possibly useful thing you've suggested is possibly disabling "distributed.." service. I recommend you delete your post. – LMSingh Jul 28 at 3:04
@LMSingh I recommend you post an answer of your own since you know everything – Moab Aug 2 at 1:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.