182

Being the good citizen I am, I left-click on the "Safely Remove Hardware" icon in my taskbar, and select my USB drive to dismount.

Then I get the message:

Windows can't stop your Generic volume device because it is in use. Close any programs or windows that might be using the device, and then try again later.

Of course, being the Operating System, it knows exactly what applications are using my device. So why won't it tell me?

Or is there a way that I can find out?

1
  • I just want to know if it's hackers in Bhutan. Can't you tell me that Windows?
    – Bob Stein
    Commented Feb 26 at 15:42

10 Answers 10

86

You can use Sysinternals Process Explorer to find the handle for any files that are open. Just select the Find menu and select Find Handle or DLL. In the dialog that opens enter the drive letter into the search box. The search results should show all of the files that are open from the drive and which process has them open.

4
  • 2
    If Process explorer shows nothing, you may use Nirsoft's OpenedFilesView software. You won't see which program is using the drive (or Process Explorer would have found it too) but you will still see the handles, the used files and have a possibility to close them (if you feel like risking it)
    – LeFauve
    Commented Jul 28, 2016 at 23:37
  • 7
    Windows Explorer itself can sometimes lock drives. You can relaunch Windows Explorer in the Task Manager in Windows 10 (scroll all the way down to find it). In older versions of Windows, you will have to End explorer.exe , and explicitly run explorer.exe from the File menu. Commented Mar 1, 2017 at 17:05
  • 1
    @ChristopherHostage Even better solution will be to never use explorer at all. This thing keeps making me more and more mad. Commented Sep 24, 2023 at 11:03
  • Windows Explorer in Windows 10 kept locking my external USB, even when I restarted it. I believe it has something to do with VMs being on my disk through Docker and/or WSL. I'm not sure of how to solve the problem, but it was only one file that svchost.exe was locking (I revealed the info through learn.microsoft.com/en-us/windows/powertoys/file-locksmith as described in one of the other answers). Commented Feb 18 at 23:27
199

Quick Solution: Install LockHunter, then right click on the file/folder/drive and choose "What's locking this ...?"

Native Method: Windows (10 at least, AFAIK) creates an entry in the event log when you try to eject a removable drive and you cannot because a process has a lock on it. The two Event IDs 225 will show the process ID and the name of the process responsible for the lock.

Step by step:

  1. Start the event viewer

  2. Open up "Windows Logs" then "System"

  3. Right click on "System" and choose "Filter Current Log"

  4. In the dialog that comes up, enter "225" (without quotes) where it says "All Event IDs"

  5. You will then see all events related to unable to eject because a process locked the drive.

  6. Look at the timestamps on all these entries and find out which ones relate to the actual time when you tried to eject the drive.

  7. Take appropriate action. Ending a task gracefully (closing the program that has the lock) is OK most of the time. Stopping the Windows Search service is also ok. Stopping an antivirus scan should be ok (if you don't suspect you have any viruses at the time). Going into the task manager and killing the process might not be ok. How to deal with this is beyond the scope of this question.

  8. (Save the view...) in Actions panel (in the right frame) you could "Save Filter to Custom View..." so you'll find it in "Custom Views" (in the left frame above the "Windows Logs")

Process ID: Event Viewer Entry

Process Name: Event Viewer Entry

  1. If you don't have another entry with a process name, the System process (process id 4) is holding your drive. To get around this one you will have to go to disk management and put the drive you want to eject offline. If the file is on your boot drive, you can't put it offline. In this case, see the note below:

UPDATE 2018: I've seen applications such as WhatsApp Desktop keeping handles on Chrome Canary via the System Process. Since you cannot eject the boot disk (beacuse it is in use), the solution was to use another nifty Sysinternals utility, called Handle. After you close the program which has the locked file, launch handle and run (as an example) handle64 "Chrome SxS\Application\chrome.exe" to see if the handles are still present on the file that has the PID 4 lock. Via trial and error, close each program running, until there are no more handles on the locked file.

UPDATE 2022: Microsoft's handy PowerToys now includes an extension to check which process is locking a file/folder. It is called File Locksmith and it is a free download. Although you can customize which PowerToy feature you want to enable, if this is the only one you will use, it's an overkill. Better to use a dedicated tool for the job.

Paid option (also works great)

Download and run SafelyRemove, by the same people who make LockHunter. I am not sure why they charge for SafelyRemove when their free LockHunter already does the job. But it helps you eject the drive and if it can't do it, it displays which processes have a lock on it:

enter image description here

8
  • 32
    Windows 10 Task Manager can prevent removal as well! Who new.
    – Alex Che
    Commented Oct 12, 2017 at 15:47
  • 1
    If nothing else works, shut down your computer then remove the external device
    – Pierre
    Commented Jan 19, 2018 at 16:23
  • I had found this procedure in addictivetips.com/windows-tips/… . Surprisingly, the Task Manager was preventing safe ejection of my USB drive. Commented May 29, 2018 at 3:24
  • 1
    I've accidentally removed removable drives too many times to leave that kind of thing to chance. Best practices must include the possibility of someone catching the USB cord with their hand when reaching for something near the computer, or the cat pushing the backup drive off the desk. Commented Feb 3, 2019 at 1:40
  • 2
    In my case, the '225' solution told me the Intel Driver Update service was the culprit. Commented Mar 6, 2023 at 20:52
41

You can also use command line to query the Windows log, with wevtutil.exe (since Windows 7) with the knowledge that the Windows Kernel-PnP uses Event ID 225 to log system (always having process id 4) refusal to remove or eject the device USB\VID_####&PID_############ (where the #'s denote hexadecimal numbers).

wevtutil qe System /q:"*[System[(EventID=225)]]" /c:5 /f:text /rd:true
  • qe System : query events from System log
  • /q : query with XPath
  • EventID=225 means the system refused an ejection request
  • /c:5 : number of entries to retrieve (5 here)
  • /f:text : format (default is xml)
  • /rd:true : reverse order (newest first)

I use it in a batch script.

2
  • 2
    I love this, it is a true copy and paste gem! Works perfectly. It shows the application that blocked eject, the process ID of that instance of the application and USB device ID that was blocked.
    – Jon
    Commented Dec 12, 2019 at 15:25
  • should be the accepted answer, copy paste solution, nothing to install, perfect, thanks Commented May 1 at 16:22
21

Microsoft's PowerToys - File Locksmith

MS PowerToys now has a handy utility that is likely to work in more circumstances File Locksmith

Once enabled, just right click on the drive in explorer and select What's using this file?

screenshot of File Locksmith in Windows explorer menu extension

PowerShell on Windows 10

Here's a quick PowerShell command to query the event log and show which application is blocking drive ejection (works for me with Windows 10, probably works with 7/8 too)

Get-EventLog -LogName System -after (Get-Date).AddHours(-1) | Where-Object {$_.EventID -eq 225} | Sort-Object TimeGenerated | Format-Table -Wrap

The output will list all instances in the past hour where the system couldn't eject a disk drive. The Message column shows the process that blocked ejection. In my example below, task manager was actually the culprit and I was able to eject after closing task manager.

PS C:\Users\Jonathan> Get-EventLog -LogName System -after (Get-Date).AddHours(-1) | \Where-Object {$_.EventID -eq 225} | Sort-Object TimeGenerated | Format-Table -Wrap

   Index Time          EntryType   Source                 InstanceID Message
   ----- ----          ---------   ------                 ---------- -------
   14692 Sep 07 10:50  Warning     Microsoft-Windows-Ke          225 The application \Device\HarddiskVolume4\Windows\System32\Taskmgr.exe with process id 11972 stopped
                                   rnel-PnP                          the removal or ejection for the device USB\VID_0781&PID_5575\200445301013C111B1A0.
   14693 Sep 07 10:50  Warning     Microsoft-Windows-Ke          225 The application \Device\HarddiskVolume4\Windows\System32\Taskmgr.exe with process id 11972 stopped
                                   rnel-PnP                          the removal or ejection for the device USB\VID_0781&PID_5575\200445301013C111B1A0.
3
  • Command line for pasting into the "New Shortcut" window: powershell -NoExit "Get-EventLog -LogName System -after (Get-Date).AddHours(-1) | Where-Object {$_.EventID -eq 225} | Sort-Object TimeGenerated | Format-Table -Wrap"
    – DBN
    Commented Apr 17, 2021 at 17:57
  • Didn't work in Win11. Try @éclairevoyant 's answer below
    – xypha
    Commented Feb 17, 2023 at 22:11
  • The latest version has "Unlock with File Locksmith" (right click on drive in This PC view). See the docs at learn.microsoft.com/en-us/windows/powertoys/file-locksmith Commented Feb 18 at 23:22
8

You can start resmon.exe (through WIN+R), go to disk > Disk Activity > Sort by File Now you can see all files being accessed by the system and which processes are accessing them, ordered by the file path (which btw starts with a drive letter). May not work with all cases, but it's a simple approach.

Restarting the computer seems "free up" device usage. Also for faster removal, you can disable windows caching on Hardware section of your device, sometimes windows will take longer than expected to flush the cache to external disk and will display that message saying that the device is in use (because it will be, by Windows itself)

1
  • 1
    Similar to this: In resmon.exe, in the CPU tab. Scroll down to the Associated Handles box. There is a Search Handles search box there, where you could enter the locked drive's letter.
    – Andrew
    Commented Feb 11, 2018 at 12:10
6

For me (Windows 7).

  1. Hit Windows key
  2. In "search programs and files: type: diskmgmt.msc
  3. In search list find entry and right click - select run as administrator
  4. Enter admin credentials to run "Disk Management" (if required)
  5. Find offending usb drive that won't eject in disk list
  6. Left hand panel, right click select "Eject"
  7. Handles "should" close - you can always double check in sys internals process explorer

Note: "Safely remove hardware and eject media" taskbar icon no longer shows usb drive - just three dots

  1. Physically remove drive
3
  • 6
    No left hand panel or Eject command in Windows 7 Disk Management. (Version 1.00, according to Help/About). I can Shrink it, Delete it, Mark it Active, Format, ... no Eject.
    – Kaz
    Commented Jul 6, 2016 at 5:32
  • 1
    Couldn't find Eject either, but the Offline option did the job. And don't forget to set it online again when reconnecting your storage device.
    – Adriano P
    Commented Sep 29, 2016 at 2:25
  • 4
    Recently I've used 'Offline' to stop my external USB-SSD disk which most probably was somehow used by system (Win 10), after that "safe remove" did work. Some time later I re-plugging that disk and have got disk with "RAW" partition. By executing of chkdsk /f f: file system was somehow re-enginerried, but everything landed in 'found.000'. So ... that method does not look to be really safe. Luckily i did not have anything really important on that disk ...
    – Xtra Coder
    Commented Nov 10, 2016 at 10:02
2

If you open "My Computer" and your drive is not listed under the "Removable Storage" headers, then Windows is viewing it as a fixed system resource for some reason. You will have to unmount any partitions on the drive.

If this is the case, open "Computer Management", then go to "Disk Management". For each partition on the device, right-click the partition, select "Change Drive Letters and Paths", and remove any drive letters assigned to that partition. Once you do so, you should find that the "safely eject" feature works as you had hoped.

0
2

If you're using powershell-core (PowerShell 7), you can use the following (limited to 5 recent events for readability's sake):

Get-WinEvent -MaxEvents 5 -FilterHashtable @{LogName='System';Id=225} | Format-Table -Wrap

This is similar to Jon's answer, but Get-EventLog is part of the old Win32 API and isn't supported in powershell-core. Get-WinEvent automatically sorts chronologically (descending) so no additional sort is needed, either.

0

I have tried this using windows 10.

Open Resource Monitor, either by searching in the start "Type here to search" or via Task Manager (right click on taskbar and then click task manager to open it).

Under Resource Monitor, column named image is used to display process name and column named File can be used to check whether the process is using your drive. E.g. File address would be F:/foo/bar.tmp then if your attached usb have Drive letter F:, you can terminate this process. column named PID is showing the process ID.

To kill a process: type in CMD or Command Prompt taskkill /F /PID pid_number

0
-1

Had USB that windows reported as being in use...same as everyone else here.

In Windows 10 Ctrl+Alt+Del gets to Task Manager.

Find by scrolling - Windows Explorer. and highlight.

Bottom right is a nice friendly button called "Restart Process"

Double triple check that "Windows Explorer" is the only thing highlighted.

Mouse left-click the friendly button "Restart Process".

I only had a single Explorer, others sometimes have two. Just note which one comes back on. Try and close/eject the USB. Mine worked fine, close the USB.

If yours does not eject/close, then probably it was the other Explorer. Try again and Restat that one. Good Luck.

1
  • 5
    Welcome to superuser: Please read the question again carefully. Your answer does not answer the original question."Can Windows tell me what is using my USB drive?"Please take a couple of minutes and read:- superuser.com/help .Answering: superuser.com/help/how-to-answer, again welcome to superuser.Thankyou
    – mic84
    Commented Mar 26, 2018 at 8:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .