If you’ve ever been told that you can’t eject your portable hard drive or thumb drive because it is “in use” even though all of your programs are shut down? Don’t worry it happens from time to time and it’s not a major problem. Something (or some process) is obviously blocking your device and stopping you from ejecting it.

Unplugging is not a good idea because then you might be looking at data loss or even corruption of the media’s file system. To avoid that, we’ll show you how to use a very advanced Windows Sysinternal tool to find the application, service, or background process that has a hold on your device and explain why.

Process Explorer to the rescue!

I’m a big fan of Process Explorer an built free Windows tool built by Microsoft which can help us out in times like these. Process Explorer shows you all currently running processes, their dependencies, their DLLs used, their exact CPU/RAM usage, all disk activity, network traffic, and a lot of other information which only the most advanced Windows kernel hackers will ever need or understand. Process Explorer is also capable of figuring out which processes are constantly using your external devices. Here’s how it works:

1.    Go to “Computer” and figure out which drive letter is assigned to your USB thumb drive, MP3 player, external hard disk, or other external device. In this example, it’s “G:”.

2.    Download Process Explorer from this URL and unpack the “ProcessExplorer.zip” file. Inside, you’ll find “procexp.exe”. Open it.

3.    Now, you’ll see a list of all currently running processes. But which one is keeping your external device busy? Look for the drive letter! Go to “Find” and “Find Handle or DLL” first. Then, type in the drive letter of your device.

Process_Explorer_Screenshot

4.    The first four entries belong to your file system which is designed to automatically block and unblock a device. Then, Windows-Explorer appears to have a lock on G:, but that disappears once I close the window. So, what is left? A process called “Iedit_.exe” with the Process ID “4336″. A quick look at the process list (or an online search) reveals the culprit: PhotoImpact X3!

5.    Now, as you might have guessed, I staged this file block with a foreground application. To do so, I simply opened a file from G:, but this might very well be a service or a process that you need to kill by closing background apps in the system tray or by forcefully killing them using Process Explorer. But be warned, forcefully killing an application could also lead to some data loss, depending on the type of application. Tough, in general, it’s safer than just yanking out the device.

And voilà! You will finally be able to remove your drive without any issues whatsoever. Of course, this solution also works with files that you can’t delete or remove.

You’ve now experienced the power of Process Explorer and understand how to look deep under Windows’ hood to solve problems easily. If you are having issues with files or external devices, just let us know!