Whenever I plug in a flash drive or my external hard drive (Western Digital
My Book), I cannot safely remove when I click on the icon. I keep getting the
message that the drive is currently in use — try again later. But, no matter
how many times I try, I keep getting the same message. I end up having to shut
down my computer to remove the device.
Well, windows certainly thinks that some program is attempting to
access the USB drive. Since it’s not guaranteed to be safe to remove a drive
while it’s in use, Windows tells you that you can’t. The “wait until later”
part is all about waiting until that program, whatever it is, is done with the
drive.
What program?
Figuring that out is the trick…
Become a Patron of Ask Leo! and go ad-free!
Here’s the message we’re talking about:
This pops up if you attempt to “safely remove hardware” on an external USB
flash or hard drive and Windows thinks that the drive is in-use by some program
on your machine.
It turns out that finding out what program that might be isn’t particularly
obvious, but we can go searching for clues.
have something open on your external drive.”
Here’s the approach I use.
First, go download and run Process Explorer – the
free Sysinternals utility from Microsoft.
In Windows 7, either launch Process Explorer with the “/e” option (as in procexp /e – note the space before the /),
or once it’s running click on the File menu and then Show Details for All Processes. This will cause Process Explorer to re-launch itself
with full administrative access. You may get a UAC confirmation. This is required to allow Process Explorer to see “inside of” all processes
on the machine.
With Process Explorer running, use its Find menu,
Find handle or DLL … function, and search for
\device\harddisk. You should get results similar to this:
You can see that the list includes several entries (yours will almost
certainly be different). And it’s not at all obvious which hard disk
each line represents. However clues are here.
In my case I looked down this list and realized that WS_10001.WMA, listed in
the right hand column, is an audio file that I was just listening to. I had
failed to close the audio player (mplayerc.exe, listed in the left hand
column). I closed the player, and “Safely Remove Hardware” worked just
fine.
It’s difficult to predict what you’ll find that might have something open on
your external drive. In my case it was simple, I’d been listening to an audio
file that I immediately recognized. The clues you get might not be quite as
obvious. In particular, check the list of programs you’ll see on the right of
your own search results list. See if any of those might have a reason to be
accessing the USB drive.
I’m guessing that some of the unexpected offenders you might find in that
list include anti-virus programs who’ve started scanning the drive,
anti-spyware tools doing the same, the Windows indexing service (you might need
to turn off indexing of the external drive) and other tools that might try to
automatically access hard drives that are found on your system.
Another useful feature of Process Explorer that you’ve pointed me to. Thanks. (I think I should take some time and just go through every menu choice and dialog box in that thing.)
In addition to “\device\harddisk”, you may also want to search for “X:\” where “X:” is the drive letter of the USB drive.
I noticed, at the bottom of a Microsoft document, the author put a comment about using “unhooker” to close any handles on the removeable drive. It is free, donate if you want, and it works great! Just r-click on the drive in explorer, unhooker shows, select it, and select close handles. Done.
I frequently have .doc files on a USB drive that I may have been editing. I use Word as my default editor for Outlook, also. I have found that I have to close Outlook in order for the “Safe to remove…” message returns. It took me awhile to find that one.
Thanx Leo It was very good article.Now I am able to resolved the problem that I ever face.
re: using “unhooker” to close any handles on the removeable drive: Just r-click on the drive in explorer, unhooker shows, select it, and select close handles. cant find this and cant unplug my WD external drive. thanks 4 the help! Susan
Also there is another way of getting rid of this problem without any additional cliks – to use USB Safely Remove ( http://safelyremove.com ). It fully replaces native safely remove utility and allows to displays programs are locking the device. It’s not free, but it’s very handy when you use USB gadgets often
closing outlook took care of the problem for me. I had sent an attachment from my usb drive and though e mail had been sent, I was still getting the “cannot be stopped error”
If you are in Vista you can use the inbuilt Resource monitor to check what is accessing the disk. Resource Monitor actually lists the drive letter so it is a little easier to identify the correct disk if you have many drives.
However I am not sure if it is present in all the flavors of Vista.
To unhook whatever is accessing your device, simply create a new folder anywhere, cut it and paste it in your recycle bin then emty your recycle bin.
now you should be able to safely unplug your device
Why, after so many years and so many versions of Windows, does Windows still do this? What SHOULD happen when the user selects a device to Safely Remove is Windows should AUTOMATICALLY and QUIETLY close all open file handles and flush all pending writes to the drive, then pop up the OK box. If for some reason it thinks some file is still open, it should present a list to the user. If the user knows nothing on the drive is in use, there should be a button to smack Windows upside the head. If the drive happens to be open in Windows Explorer, Windows should simply and QUIETLY move to C: or somewhere else WITHOUT COMPLAINING, just like it does when you eject a CD while looking at it with Windows Explorer.
Why, after all this time, does Windows not behave in this logical manner? Will the current dumb behavior be perpetuated in Windows 7?
The drive may also be optimized for quick removal as opposed to performance in the device manager. If you check it in the list of drives you can change the option with a restart required.
I am having this problem right now. I wish there was a way to know which disk is which (\Device\HarddiskN etc.). However, the drive properties in Device Manager say that it’s optimized for quick removal and “this setting disables write caching on the disk and in Windows, so you can disconnect this device without using the Safe Removal icon.” I am just going to do that, by lack of an alternative. It is empty right now anyway, I just formatted it and wiped it with PGP Shredder to eliminate malware that often comes with new flash disks.
Question: doesn’t the error occur simply because of the “quick removal” setting, meaning Windows has no cache to flush and can’t “remove” something that is already not permanently attached?
Ray wrote:
To unhook whatever is accessing your device, simply create a new folder anywhere, cut it and paste it in your recycle bin then emty your recycle bin. Now you should be able to safely unplug your device.
SORRY RAY, THIS DOES NOT WORK FOR ME.
It is insane that MicroSHAFT has not fixed this crazy bug and everyone has to suffer for it. There are NO APPLICATIONS running and I cannot remove the USB drive because it says there are applications running. Crazy. This is why some people HATE computers, can you blame them???
My Windows XP ALWAYS gives me this message, no matter what. There is no program using the USB drive. I can plug it in, copy one file onto the USB drive with Windows explorer, then shut down windows explorer, and it will still give me this message. I always have to shut my computer down to disconnect a USB drive.
/device/harddisk returns 0 results. I guess this doesn’tw ork with windows 7? Thanks anyway.
If you have AVG then that is the cause. It is a big bug that they plan to fix in the next version
http://forums.avg.com/ww-en/avg-free-forum?sec=thread&act=show&id=65437#post_65437
Response to “didn’t work” who commented “/device/harddisk returns 0 results” – maybe it would work if you tried “\device\harddisk” as advertised?
\device\harddisk
doesn’t works on w7
For whomever follows, in Windows 7 make sure that you click on File -> Show Details for All Processes. The security model in Windows 7 has of course changed somewhat. This option causes Process Explorer to re-launch itself with full administrative access. You’ll probably get a UAC confirmation when you do it. Without this Process Explorer can’t see inside of all processes.
07-Jul-2010
I have the same problem, under Win 7, and after using Process Explorer in the All Processes mode, I see that PID 4 is the culprit, accessing several metadata and volume info files. This was also identified in the Event Viewer Warning associated with not being able to eject the USB drive. Task manager shows PID 4 to be “System”, with description “NT Kernel & System”. Pretty obvious that I can kill this process. What do I do, short of shut down??
I get it in WXP.
Download Unlocker (Google it, or http://unlocker.en.softonic.com/) Start Unlocker, find offending USB drive in the list, Click/double click, click ‘Unlock all’ (or all of the tabs!), message should have disappeared when you now try again.
Most of the time it is the System Volume Information folder being accessed for creation / addition of Restore points which are not needed on USB drives.
I disable System Restore on all Drives except the Windows System drive, in most cases c:
With system restore disabled on all other drives & without any explorer windows focused on any of the drives’ (sub)folders, I rarely encounter this sort of dialog.
Ravi.
yes !
please elaborate on “disable System Restore on all Drives …”
under the ‘system protection’ tab
however, my external usb hdd is already turned off
i also thought that ‘backup and restore’ might be saving data to the usb hdd, so i turned off the service
finally, i changed the ‘properties’, ‘policies’, in ‘device manager’, from ‘performance’ to ‘quick removal’, however, met with a ‘reboot’ prompt. defeating the whole purpose of ‘safely remove’. i mean, i can already shut down the system and remove the device, but would rather not
I was thinking to use Process Explorer as Leo recommends but I’ve got it installed as a portable version on the HD I want to remove! ;-)) Talk about shooting myself in the foot! (but then I suppose it would be useful to find what else is jamming up the system!)
I had the same problem with the PID 4/System process. The solution Michael Carter proposed worked for me: I opened the Task Manager, closed explorer.exe in Task Manager and then re-opened explorer.exe in Task Manager. I was then able to remove the external hard drive without a problem. Let me add that this problem occurred repeatedly during the FIRST TIME I used my brand new Windows 7-running laptop. I will shortly contact Microsoft about this.
I get this error all the time and I thank the author for providing a useful way to find out what is causing the problem. I’ve found that frequently it’s Microsoft’s own software that does it; for example, if you’ve saved an MS Word file to a usb drive, Word will hold onto the drive even if the file is closed until and unless you close out of Word altogether. I find it rather ironic that Microsoft’s operating system is incapable of controlling the behaviour of Microsoft’s own applications. It might be different if it were a third-party app that was going a bit rogue, but when it’s MS going rogue on itself, well….
13-May-2012
Download ‘Unlocker’: works perfectly for me.
Les Millgate
Download ‘Unlocker’: works perfectly for me.
Les Millgate
Rick Broida of PCWorld recently had an article about this. He says (with the USB device plugged in) to right click “My Computer” on the desk top, select Properties then the Hardware tab. Click the Device Manager and expand the Drives device. Right click your USB device and again select Properties and under the polices tab make sure the “Optimize for Quick Removal” is selected. Then he says you can just remove your USB device without loss of data. Do you trust your data to it?
Well, here we are five years after the first comment! And the bug is still with us! Nothing like stability.
Windows 7 Home Premium
Procexp Version 15.22
Procexp File menu has no Show Details for All Processes
I run with admin.
USB drive, set for quick removal
When I run Macrium Reflect, and exit, Task Manager shows ReflectService.exe running, and Procexp’s Find shows process System with Macrium files. When I click a line in Process Explorer Search window, the corresponding line in Procexp’s main window’s lower pane is highlighted. When I right click the highlighted line, and select Close Handle, I get the error “Error opening process: The handle is invalid.”
Procexp doesn’t show ReflectService.exe.
Killing ReflectService.exe with Task Manager made no difference; Procexp’s Find still showed the Macrium files.
(I know why. The programmer who wrote the code sold his Microsoft stock and retired to the Riviera.)
– cont –
so, after making sure that 1. the drive is not being monitored for restore
2. that ‘backup and restore’ is not using the disk
3. set the device to ‘quick removal’
i finally came full circle to having to use process explorer using ‘find’ “i:\”
it is being used by ‘system volume information’, with process name ‘system’, and process id 4
i can not turn off individual system volume information processes from the search results, so i went to kill the process from task manager. lol. it didn’t work