How to check what process is your holding external device

Updated: February 4, 2012

If you are a Windows user, you may have seen now and then a prompt that tells you an external disk cannot be ejected now, because it in use. You can force eject the device, but there's a risk of losing valuable data. So the big question is, how do you go around a problem like this?

Today, we shall learn how to utilize the power of the Windows Sysinternals toolbox to find out exactly what processes are holding files on our external devices, so that we may take the necessary corrective actions and allow safe removal of our media. This topic is a bit geeky, but if you ever wondered if there's a similar utility to Linux lsof in Windows, the simple answer is, yes there is.


Find what is using the device

Enter Process Explorer. This is a super-powerful process management tool, rather similar to Linux lsof. Not only will it show you the process list, it will also report back the file handles, DLLs used by different tasks, network and disk activity, and a lot more.

Now, a scenario: Say you have an external device that you want to eject. This happens to be an external USB thumb drive, called P. You try, but you get the cursed error. So what do you do now?

You open Process Explorer and click on Find > Find Handle or DLL ... This will open a search window where you can input a search string. What we need in our example is to find anything that might be holding the P drive, so we will search for P:\.

Find handle

Progress! We see that there are two file handles held against the P: drive. We also learn that vlc.exe, a media player with the PID 7112, is holding the device, since it is playing a song directly from the device. At this point, we can kill VLC or try to resolve the problem more elegantly.

If you select the shown handle, you will get more information on the process holding the handle shown in the bottom pane of the Process Explorer and learn about any potential caveats of killing the offending process or force removal. Some system knowledge is necessary to determine whether you risk losing data if you go about a violent resolution. But in most cases, you will be able to resolve the issue more gracefully.

Detailed info

Not necessarily external devices!

The phenomenon and the solution are not specifically limited to external devices. You might be having a problem with file deletion, renaming, copy, anything that might sour your weekend. No need to despair or reboot.

Cannot close, file in use

More reading

And you may also be interested in the following tutorials:

Nirlauncher - The perfect toolbox for Windows geeks

Windows Management Interface Console (WMIC) - The Windows secret weapon

Microsoft PowerShell - Lindows?


This is a very short tutorial, so the conclusion is equally short. Nevertheless, the message is quite powerful. You learn about manipulating the stuff that is under the hood, the process space, the handles, etc. You learn about ProcessExplorer, the very useful and handy tool for Windows people. And you learn that there's no reason to panic or despair when faced with a seemingly obscure problem that has no visual clues.

Well, that would be all for this time, have fun!


You may also like: