75

I have an external HDD which I would like to "safely remove". Unfortunately, my system (Windows 7 x64) complains that "the device is currently in use".

Using Process Explorer I discovered which process is holding a handle on the device:

Process Explorer Screenshot

Obviously, System is not a process that I can just kill and be done with it. I've done a bit of research and this seems to be a common problem, but no solution has been found so far (except for rebooting the machine, which I'd like to avoid if possible).

Is there any solution to this problem that I've missed?

1
  • 8
    MS still haven't fixed this in Windows 10 Jul 26, 2016 at 9:27

12 Answers 12

37

I've always had this problem with one of my Toshiba external drives. I value that drive really high because of its built-in shock detector, what is currently very hard to find. But the cannot-remove-it-safely issue was driving me crazy.

Today, I've hit this question/thread on social-technet MS site. While there's a lot of noise down there, they point out a few common issues. Like the Distributed-Tracking service. It's actually hard to read through it all due to some cohones-size-flame-war that escalated at some point, but reading the topic from its end helps;)

Anyways, sorry for my chatty mood, I've just fixed my case permanently.

I've got any Distributed-Tracking/Windows-Search/etc services off and was still unable to safely-unplug the drive. Someone somewhere suggested that "quick removal" is the culprit, but almost all my USB drives run on it and I still can remove them safely.

However, I actually tried switching this drive to "high performance mode" and .. it caused the TxfLogContainerXXXX handles to evaporate. So, it's true that this is the quick-removal option. However, this did not released my drive yet. Still couldn't eject it.

Then I have went to ComputerManagement->DriveManagement utility and I have removed any drive-letter assignements for that drive. Instantly afterwards, I was able to eject the drive.

Then I tried connecting it again, reassigning the drive letter, switching it to quick-removal and it seems to work properly and still be ejectable.

On the so-long topic on MS site, they also mention these actions. Someone suggested to:

  • change drive letters and reboot
  • or, try turning the drive "offline"

I think that the "turn the drive offline" via "computer management -> drive management" might actually be the quickest solution, however I have not tried it since my random attempts helped before I've read about that.

6
  • 2
    I had the same problem (caused by the same lock on \$Extend\$RmMetadata\$Txf), but in my case I was unable to dismount a TrueCrypt drive. I use Voidtools Everything and that process turned out to hold the lock. Solution: kill Everything before dismounting or make sure to have the drive mounted as a "removable medium" in the TrueCrypt settings. Files on that drive will then not be indexed by Everything.
    – mgr326639
    Sep 11, 2015 at 12:33
  • On Windows 8.1, I was able to change the drive letter, and then just eject the new drive letter from the system tray. Thanks.
    – Adrian
    Nov 5, 2015 at 14:07
  • 1
    On Windows 7 x64, I was able to change the drive letter, and it ejected fine.
    – Contango
    Jan 9, 2016 at 21:38
  • Couldn't put an external USB 3.0 drive offline as the option was greyed out (Windows 7 x64), but removing the assigned drive letter in Disk Management worked like a charm! Thanks!
    – lightproof
    Jun 3, 2017 at 18:25
  • Another option have has worked for me along with the offline workaround is to relogin without reboot.
    – Andry
    Oct 30, 2020 at 20:26
9

I had the same problem and found indeed that turning the drive offline is the fastest option as @quetzalcoatl already said.

Still a small caveat: after you turned the drive to offline, you should flip it back to online else next time you attach the drive it won't start and be recognized by the system.

Below is a very small script to automate the process, inspired by this:
https://groups.google.com/forum/#!topic/alt.msdos.batch.nt/dRhFTCtLJ3A

@echo off
:loop
echo list disk|diskpart|find "Online"
set "disk=."
set /p "disk=Pick disk number above to put offline: "
echo.
echo list disk|diskpart|find "Disk %disk%"
if errorlevel 1 (
echo  Invalid drive selection!
pause
goto :loop
) else (
pause>con
echo select Disk %disk%
echo offline Disk
echo online Disk
echo exit
)| diskpart

Remember to run the batch file as administrator, and to press a key after you selected the disk number.

5

For me, the issue was caused by having file-content indexing turned on on the drive (which is on by default)

To disable it:

Right click the drive > Properties > Uncheck Allow files on this drive to have contents indexed in addition to file properties

After disabling contents indexing, I was able to eject the drive.

2
  • 6
    I just tried that. Half a day later, Windows Explorer is still walking through the files, unsetting this attribute on each and every one of them. Would it have sufficed to unset this attribute on the root directory of the drive?
    – Heinzi
    Jan 5, 2017 at 16:59
  • 1
    Unfortunately, that this did not fix the issue for me: Just tried ejecting the device, same problem.
    – Heinzi
    Jan 10, 2017 at 13:00
2

Five years later, I actually fixed this issue by resorting to a commercial tool: USB Safely Remove, which can "force stop" a device suffering from this issue. (Before that, I used the "take offline" workaround mentioned in quetzalcoatl's answer.)

Note: I am not affiliated with the creators of the software, I just mention them because their tool fixed the problem for me.

1

If your disk is set for quick removal (in drive policies) you should be able to safely unplug it without using the "safely remove" option.

I had the same error as Heinzi, but when I tried to solve it by changing the mode to "better performance", I noticed what the default option actually does :)

It sounds dangerous but perhaps without caching there really should be no worries?

BTW, my drive is a WD-500 and in drive management there is no option to turn drive offline.

2
  • 1
    The only worry is if some application decides to write to the disk at the time you eject it. Unless you know for sure that the process that has the handle to that drive is actually not going to write to the drive, it is a little risky. YMMV.
    – Adrian
    Nov 5, 2015 at 14:09
  • @Spikolynn "Offline" option is available when you right-click the grey (leftmost) part of the Disk row.
    – sm4rk0
    Jul 19, 2017 at 10:35
1

What worked for me was a combination of the several answers:

  • In This PC, right click the drive, select Properties, uncheck Allow files on this drive to have contents indexed in addition to file properties and select Applyand select Apply change to drive, subfolders and files(For several almost full 500Gb HD it took about 30sec).
  • Open Start, search for Create and format hard disk partitions, find your HD right click somewhere on the grey block on the left and select Offline (cf the printscreen below)

Now you can eject your device.

But be careful because the next time you will plug itin, it will still be set as Offline so you will need to set it as Online. The best is probably to do it right away: just after you eject your drive, replug it, set it as Online.

Why these two steps? Probably because unchecking the indexing doesn't force the current indexing to stop. But this can be done by setting the device as Offline.

● If the next time you still can't remove your Device, open Process Explorer (or process Hacker), open the Handles, search for your device letter (ex: H:) and MsMpEng.exe` and select close.

enter image description here

1

Yes this is such an annoying issue - that persists to date.
What needs to be done is to free that handle on the external drive using a tool like Sysinternal's Process Explorer.

  1. Identify the blocking process from:
    Event Log : Event Viewer > System > Warning - Source:Kernel-PnP > ProcessName
    e.g. The application \Device\HarddiskVolume<>\ProgramData\Microsoft\Windows Defender\Platform\<>\MsMpEng.exe with process id <> stopped the removal or ejection for the device USB\VID_<>&PID_<>\<>
  2. Locate this process in ProcessExplorer (Run as Admin)
    e.g. winnt.exe > services.exe > MsMpEng.exe
  3. Locate the blocking handle from handles list for the process:
    View > Lower Pane View > Handles,
    Sort list by Type, Look for File with Name as: \Device\HarddiskVolume<> - the index will be one of the highest numbers across other similar handles
  4. Close Handle from the shortcut menu on the handle

Now you should be able to eject the drive.

(If there are other handles created by an active scan from Windows Defender - exclude the root of the drive by adding it the Windows Defender exclusion list:
Virus & threat protection settings > Exclusions

0

Setting Removal policy to better performance from devmgmt.msc did not help for my 1TB Seagate Expansion Portable Drive. Only when i used services.msc to turn off "Crypkey License" it worked immediately.

0

Tried all of the other answers suggestions like changing/removing the drive letter, turning it offline, but those methods did not work.

I'd rather not play with toggling it's behavior and keep it set to quick removal.

USB Safely Remove did help, but maybe not directly when quickly clicking the drive in the main listing. When it showed me more than LockHunter would besides the *Metadata files in the root of the drive, there was also MsMpEng.exe operating on it. Forcing the stop of the files used by that process seemed to help me remove it.

For other drives or situations, I finally found Open Hardware Monitor seemed to have a lock on it, even when I haven't found other specific proof for that yet. I'd rather not close the program as I have to set my fan speed every time though.

0

I had a very similar situation, and for me there are 2 questions and thus 2 answers:

  1. What is using those file handles & can I safely force close them?

  2. How do I safely unplug the drive?

I haven't seen any good answers for #1 but for #2:

tldr;

  1. To my best amateur knowledge, it sounds like if you are using Quick Mode, you can just unplug a drive without using "Safely Remove" once you are done copying files, etc.
  2. If "Safely Remove" doesn't work, try Start -> Settings -> Devices -> Remove Device.

Explanation

According to ms docs on Safely Remove...:

To avoid losing data, it's important to remove external hardware like hard drives and USB drives safely.

  1. Look for the Safely Remove Hardware icon on the taskbar. If you don't see it, select Show hidden icons . Press and hold (or right-click) the icon and select the hardware you want to remove.
  2. If you can't find the Safely Remove Hardware icon, press and hold (or right-click) the taskbar and select Taskbar settings .
  3. Under Notification Area, choose Select which icons appear on the taskbar.
  4. Scroll to Windows Explorer: Safely Remove Hardware and Eject Media and turn it on.
  5. If this doesn't work, make sure the device has stopped all activity like copying or syncing files. Select Start > Settings >
  6. Devices. Select the device, and click Remove device.
  7. Finally, check with the hardware manufacturer for new drivers or other updates.

My takeaway from this (and this worked for me), was that the "Remove device" button under Settings is more powerful than the "Safely Remove Hardware" icon in the taskbar.

Also, as other's have mentioned, the removal policy setting on the drive is relevant:

Windows defines two main policies, Quick removal and Better performance, that control how the system interacts with external storage devices such as USB thumb drives or Thunderbolt-enabled external drives. Beginning in Windows 10 version 1809, the default policy is Quick removal.

In earlier versions of Windows, the default policy was Better performance.

You can change the policy setting for each external device, and the policy that you set remains in effect if you disconnect the device and then connect it again to the same computer port.

More information

You can use the storage device policy setting to change the manner in which Windows manages storage devices to better meet your needs. The policy settings have the following effects:

  • Quick removal: This policy manages storage operations in a manner that keeps the device ready to remove at any time. You can remove the device without using the Safely Remove Hardware process. However, to do this, Windows cannot cache disk write operations. This may degrade system performance.

  • Better performance: This policy manages storage operations in a manner that improves system performance. When this policy is in effect, Windows can cache write operations to the external device. However, you must use the Safely Remove Hardware process to remove the external drive. The Safely Remove Hardware process protects the integrity of data on the device by making sure that all cached operations finish.

What I get from the above, is that if I use "Quick removal", I don't need to worry about using "Safely Remove...". I guess I still shouldn't unplug while in the middle of something...

-1

I plugged in the USB flash drive before booting into windows 7 and I couldn't un-mout it (safely remove). After stopping the "Windows Search" service I could safely remove the drive. I only had the problem if the flash drive was connected to the computer before the Windows startup.

1
  • It seems OP problem is different from yours
    – Sam
    May 16, 2017 at 8:03
-1

Possible solution for those with Everything Search: I've had this problem for years. Tried many suggestions and many apps, including Zentimo and USB Safely Remove.
Even disabling the indexing of file contents, and disabling the Windows Search service didn't help.

I'm currently using Windows 11 x64 en-US with VoidTools Everything running as a service. I began a thorough investigation into the matter of the System process and/or svchost.exe and/or Everything64.exe and/or MsMpEng.exe blocking the ability to safely remove an NTFS drive (be it USB or SATA attached).
I didn't want to shutdown the system or bring the drive offline/online just to eject it, as some have suggested. These solutions weren't convenient enough for me.

Looking into the System event log, I got these Warnings about "The application System with process id 4 stopped the removal or ejection for the device...". So I started up Process Monitor (procmon.exe) to see what's going on.
I found out that the service "Distributed Link Tracking Client", AKA TrkWks is the true culprit (or so I thought, read on). It keeps an open handle to the file \System Volume Information\tracking.log. Hence, trying to eject said drive fails.

By default, the TrkWks service is set to Startup Type "Automatic" with status "running".
Stop the service, and you should be able to safely eject the drive without issue.
I've decided to set it to Startup Type "Manual", so it can be started on demand for proper operation of Windows, but at least now it does not run automatically.

EDIT 2024-02-16:
Well, even with the TrkWks service not running, I still had issues ejecting the drive. So after probing some more with procmon, and trying out several ideas, it seems that the fact that Everything64.exe accesses the USN Journal of the drive - it may actually be the problem.
I removed the drive from the NTFS index - UNCHECKED "Include in database", which also disables the use of the drive's USN Journal, and added the drive in the "Folders" so it can still be indexed and monitored without the use of the USN Journal.

enter image description here

Now I can eject the drive. I even started the TrkWks service, and I was still able to safely eject the drive. Will continue to check to make sure this indeed is the proper solution...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .