Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a WD 1TB Elements external hard drive and every time I use the Windows 7 "safely remove" feature, it gives me a dialog telling that a process is using the disk.

Using Sysinternals Process Explorer and the answer on this question (find everything with the drive letter) I get the following result:

Process Explorer "find" results

What is the $Extend folder and why is it in use? How can I disable it? I cannot remove it using the command line (access denied).

Edit: I've followed the instructions over here and under the registry key


I have a

Multi-String Value named IgnoreNTFS with data \$Extend* /s

But this does not make any difference. Also this question is not about a server.

Additionally I can tell that I use a program called mkv2vob to convert video files with a Matroska container into something my PS3 will play. I convert the source files straight from my external HDD, but I would expect if this program does not release the lock on the HDD, surely it cannot be locked if the process isn't even running?

share|improve this question
I've had the same problem on my Vista laptop. I looked for programs using the drive but couldn't find any. So what I do is sleep the box. Ten seconds after the box goes to sleep I can hear the drive shut down, at which point I unplug it. Been doing this daily for months with no problems. –  Daniel R Hicks Dec 1 '12 at 13:47

5 Answers 5

Windows 7 is trying to Backup to your external Hard drive, You can disable backups to external disk drive. Sample solution is here.

share|improve this answer
it's a windows feature. I don't know why did windows do something like this. –  Hasan Hüseyin Çakır Nov 26 '12 at 20:29
Okay I just got this again. Exactly same window as in original question. –  MDeSchaepmeester Nov 29 '12 at 21:45

Got the same problem with a different external disk used for backup of the system disk. I identified the TxF file locks using LockHunter, which wasn't able to unlock them.

I hear Transactional NTFS is used by autoupdate, but have no clue why the system would want to place this on an external disk and then be unable to stop it upon safe removal request. Fsutil resource info doesn't show any activity.

Try in the cmd console:

fsutil resource stop E:

or, if it doesn't help,

fsutil resource setautoreset true

and reboot. You can also try stopping a TxF-related service in Computer Management / Services

share|improve this answer
Thanks, I will try this. –  MDeSchaepmeester Dec 7 '12 at 12:02

This doesn't resolve your core issue, but it is too long for a comment and answers one part of your question.

'What is the $Extend folder and why is it in use?

The $Extend folder is used by windows to store various things relating to the NTFS filing system such as quota information and NTFS log files. See this MSDN article for more info.

In your case you are interested in the \$Extend\$RmMetadata folder which is part of the Transactional NTFS system. This is an essential part of windows and can't be disabled, although I would have expected that you can disable it for one particular drive, but unfortunately I don't know how.

There is a command line program called fsutil which can be used to display some information about these files (eg fsutil resource info e: and fsutil transaction list which perhaps could indicate which process is using this feature. There are other commands to start and stop the resource manager, but I'm not going to recommend that as I don't know the consequences, but it might give you a starting point to research further.

By the way, the instructions you are following re the Backup aren't really relevant to your situation. They only apply if you are actually running a backup and the backup is failing because these files are locked and the solution is just to configure the backup to ignore these files.

share|improve this answer
Thanks for the information. –  MDeSchaepmeester Dec 7 '12 at 12:03

I've recently discovered that restarting the "Server" service (which will generally require Windows to also restart dependent "Computer Browser" service and possibly the "HomeGroup Listener" service at the same time) allows me to then safely remove the drive. I don't know if this is actually safe to do or not, but it does work.

share|improve this answer
I'll try this if it occurs again. –  MDeSchaepmeester Jun 4 '13 at 10:51

As explained by Rook in this answer: http://superuser.com/a/674255/142560

To safely remove the drive:

  1. Open Command Prompt (cmd.exe).
  2. Type diskpart.
  3. Type list disk.
  4. Find your disk #, and type select disk [number here].
  5. Type offline disk.

You should be able to remove it now.

Next time you plug it in, it won't be automatically mounted. So either use the command prompt again to make it online, or:

  1. Run diskmgmt.msc.
  2. Find the disk, right click, and choose "Online".
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.