8

I have a volume mounted by TrueCrypt. All works fine, except when I try to dismount it (after verifying I don't have any application or explorer using anything in it). Every time I click the Dismount button, I receive this error:

Volume contains files or folders being used by applications or system. Force dismount?

enter image description here

I fired up Sysinternals' Process Monitor, filtered on the path beginning with that drive letter and noticed strange results in which I swear that I have not attempted to access that drive with any of the applications listed (Explorer.EXE, SnippingTool.exe, firefox.exe).

All 3 applications show the same type of "access" (with SUCCESS result):

  • CreateFile: Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: None, AllocationSize: n/a, OpenResult: Opened
  • QueryNameInformationFile: Name: \
  • QueryInformationVolume: VolumeCreationTime: 2/10/2015 10:04:26 PM, VolumeSerialNumber: D753-7E32, SupportsObjects: True, VolumeLabel:
  • QueryAttributeInformationVolume: FileSystemAttributes: Case Preserved, Case Sensitive, Unicode, ACLs, Compression, Named Streams, EFS, Object IDs, Reparse Points, Sparse Files, Quotas, Transactions, 0x3c00000, MaximumComponentNameLength: 255, FileSystemName: NTFS
  • CloseFile:
  • CreateFile: Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Free Space Query, Attributes: n/a, ShareMode: None, AllocationSize: n/a, OpenResult: Opened
  • QueryFullSizeInformationVolume: TotalAllocationUnits: 4,194,303, CallerAvailableAllocationUnits: 2,425,717, ActualAvailableAllocationUnits: 2,425,717, SectorsPerAllocationUnit: 8, BytesPerSector: 512
  • CloseFile:

I tried disabling indexing for that drive (and all its subfolders and files by unchecking the corresponding checkbox on the drive's properties page, but that didn't help.

enter image description here


The only ACCESS DENIED on Process Monitor is shown for TrueCrypt's FileSystemControl operation:

Control: FSCTL_LOCK_VOLUME


Interestingly, if I mount that drive and immediately dismount it (without attempting to access it via Explorer even once), then it dismounts without any error.


The worst part of this problem is that if I go ahead and click Yes (force dismount), Windows 8.1 crashes with BSOD (the blue screen of the death). Obviously this doesn't make this tool very useful.


Any idea how to get rid of this error message? Disable a Windows service or feature that causes this?

  • 1
    As a part of your troubleshooting, did you check what exactly caused BSOD from the logs? It could be of some help here. Besides, did you try Logging Out and Logging In to unmount? -- This won't answer the reason behind the issue, that I know, but could be a workaround to the issue. – Firelord Mar 29 '15 at 12:48
  • TrueCrypt was discontinued about a year ago; I've been using DiskCryptor ever since. If I were you I'd grab everything from the TrueCrypt area and move it to a platform that's being currently maintained. As time progresses it will get worse since it isn't being developed anymore. – Jason Locke Mar 31 '15 at 21:25
1
  1. You might install CrystalRich's LockHunter to see what processes have open file handles for the TrueCrypt volume.

  2. Is your AV accessing files?

  3. re: "TrueCrypt discontinued," it has already been partially audited and no major flaw or backdoor (in AES) has been found. See How-To Geek and E. Ciurana for comments on TrueCrypt. If you do want to switch encryption software, either to resolve the locking issue or for security reasons, aee AlternativeTo: TrueCrypt... currently, VeraCrypt has a slight lead. Note that if you do switch to VeraCrypt, all current TrueCrypt containers will need to be recreated.

| improve this answer | |
1

Chiming in a bit late -- I ran into the same problem with VeraCrypt containers created in disk partititions (disk partitioned into three sectors -- one small normal-type drive for storing backups of my software including VeraCrypt, KeePass, and my KeePass keyfiles and also two VeraCrypt partitions on the same portable hard drive). The VeraCrypt partition containers started to dismount properly once I turned off indexing for the normal-drive container -- apparently the indexing process was interpreted as an active access request for all partitions on the same physical disk.

| improve this answer | |
0

I realize this is a year-old question, but since I found it while looking for a solution myself, and there's no solution posted, let me provide mine.

Short answer: something seemed to have gone bad in the TrueCrypt container that prevented dismount. Creating a new TrueCrypt container and moving the files from one to the other resolved it.

I recently had exactly the same problem as the OP here, and quickly was able to narrow it down to a single TrueCrypt container. I had another container on the same physical USB thumbdrive, and another container on a second thumbdrive, and neither of those had problems. When I copied the container (and the problem-free container) to a new drive, the container continued to have the same problem, even on the new physical thumbdrive; and the problem-free container contiued to be problem-free on the new thumbdrive.

I allocated a new container and copied over the files, and the new container dismounts properly.

I surmise that, either because the old thumbdrive was getting flaky or maybe I removed without dismounting properly, something in the container got damaged. Not enough to impair the data, but to keep from dismounting cleanly. Either way, recreating the container did the job for me.

| improve this answer | |
-1

For all you TrueCrypt users, VeraCrypt is the next name for TrueCrypt, it is a TrueCrypt with name changed, and some more security and more options.

They took the code form TrueCrypt and follow from there. Now i use both: TrueCrypt for Old ones, and VeraCrypt for new ones.

And veraCrypt is been actaully mantained and with new features coming, they have in mind to be able to encrypt windows system partition on a GPT disk (no MBR, no BIOS) for UEFI systems, they do not have idea of when but are trying their best on it, getting knonledge of UEFI boot and how windows boot from GPT disk partition scheme.

Maybe this can help.

P.D.: Souce code of VeraCrypt is Source Code from TrueCrypt with fixes and extras added, same GUI, etc with some 'extras'.

| improve this answer | |
  • This doesn't actually answer the question. – Chenmunka Feb 25 '16 at 14:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.