External HDD is always in use when trying to safely remove

Question

I have a WD 1TB Elements external hard drive, and every time I use the Windows 7 "safely remove" feature, it gives me a dialog telling that a process is using the disk.

Using Sysinternals Process Explorer and the answer on this Can Windows tell me what is using my USB drive? question, I get the following result:

Process: System, PID: 4, Type: File, Names starting with E:\$Extend\$RmMetadata\$Txf

What is the $Extend folder and why is it in use? How can I disable it? I cannot remove it using the command line (access denied).

Edit: I've followed the instructions over here on Microsoft TechNet, and under the registry key

HKLM\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToBackup

I have a multi-string value named IgnoreNTFS with data \$Extend\* /s.

But this does not make any difference. Also, this question is not about a server.

Additionally I can tell that I use a program called mkv2vob to convert video files with a Matroska container into something my PS3 will play. I convert the source files straight from my external HDD, but I would expect if this program does not release the lock on the HDD, surely it cannot be locked if the process isn't even running?

Solution 1

As explained by Rook in this answer: https://superuser.com/a/674255/142560

To safely remove the drive:

1. Open Command Prompt (cmd.exe).
2. Type diskpart.
3. Type list disk.
4. Find your disk #, and type select disk [number here].
5. Type offline disk.

You should be able to remove it now.

Next time you plug it in, it won't be automatically mounted. So either use the command prompt again to make it online, or:

1. Run diskmgmt.msc.
2. Find the disk, right click, and choose "Online".

Solution 2

Got the same problem with a different external disk used for backup of the system disk. I identified the TxF file locks using LockHunter, which wasn't able to unlock them.

I hear Transactional NTFS is used by autoupdate, but have no clue why the system would want to place this on an external disk and then be unable to stop it upon safe removal request. Fsutil resource info doesn't show any activity.

Try in the cmd console:

fsutil resource stop E:

or, if it doesn't help,

fsutil resource setautoreset true

and reboot. You can also try stopping a TxF-related service in Computer Management / Services

Solution 3

Windows 7 is trying to Backup to your external Hard drive, You can disable backups to external disk drive. Sample solution is here.

Solution 4

I have had this same issue every time I used my external USB drive to my Win 8.1 desktop. The only way I could properly eject it was by going into Disk Management and then taking the disk offline. It's really painful though as you then have to put it online when you next plug it in.

But, just today I went into the disk's Device Properties (from Device Manager or from the Hardware tab in any disk's properties dialog) and found that the the disk's Removal policy was set to Quick removal:

Quick removal

Disables write caching on the device and in Windows, but you can disconnect the device safely without using the Safely Remove Hardware notification icon.

The other option is:

Better performance (default)

Enables write caching in Windows, but you must use the Safely Remove Hardware notification icon to disconnect the device safely.

Just out of curiosity I changed the removal policy to Better performance and sure enough after I did that the Safely Remove Hardware eject function worked fine and I could eject the disk without the dreaded "Disk is in use" error. I have no idea why the policy would make any difference since I was trying to safely remove either way but I haven't had any problems since so give it a try.

Solution 5

I've recently discovered that restarting the "Server" service (which will generally require Windows to also restart dependent "Computer Browser" service and possibly the "HomeGroup Listener" service at the same time) allows me to then safely remove the drive. I don't know if this is actually safe to do or not, but it does work.

View more solutions

Comments

[Daniel R Hicks]

I've had the same problem on my Vista laptop. I looked for programs using the drive but couldn't find any. So what I do is sleep the box. Ten seconds after the box goes to sleep I can hear the drive shut down, at which point I unplug it. Been doing this daily for months with no problems.

[janot]

Possible duplicate of Safely remove external USB drive fails due to $extend

[Hasan Hüseyin Çakır]

it's a windows feature. I don't know why did windows do something like this.

[MarioDS]

Okay I just got this again. Exactly same window as in original question.

[MarioDS]

When I still had the disk, I was pretty sure I had it in performance mode. Actually I'm pretty sure that quick removal is default. I'm not too lazy to use the eject feature which is why I went for increased performance, and yet I couldn't use eject (IIRC).

[Mark Larson]

This seems to have done the trick for me, and is much easier than taking the disk offline. I'm more comfortable using Safely Remove Hardware with a hard disk anyway.

[barlop]

+1 i've had fsutil resource stop f:\ work in the past and no doubt will in the future, but this time, fsutil didn't work, and after every attempt to dismount it was locking, this worked for me. So it makes for a good second step if fsutil doesn't do the job.

[barlop]

not getting any info that gives me any hints pastebin.com/raw.php?i=aNDaC2GR

[barlop]

It doesn't work for me. It removes the handles to the drive.. so process explorer shows no handles, and then I thought ah now it'll work. But when I chose to remove the drive, then I got that same error. And then process explorer shows handles rmmetadata handles on it. It did say that it needs a restart after that setting though. And I haven't restarted.

[barlop]

heh, this time I get that error even after choosing offline then choosing to remove the drive!

[barlop]

just tried it , fsutil resource stop, now.. and it worked and also removed the drive from the safely remove tray thing, don't think i've seen the latter before but ok.

[barlop]

Unless it's the case that process explorer didn't show that, and you state that, then this is not useful and not necessarily answering the question. Clearly various programs can cause it, almost any that are using the drive can cause it. To answer the Q it has to be that the program isn't listed in process explorer.

[Ramhound]

This answer does not appear to answer the author's question. You also have reference links which you failed to properly cite and quote all relevant information.

[Robert]

In most cases you can directly after execute offline disk execute online disk and the volume can still be unmounted using the tray icon. This has the advantage that next time you plug it in, it will be automatically mounted as usual.

[Robert]

@barlop I don't see the point in your comment. The answer is valid as it exactly describes a possible solution for the situation shown in the question.

[barlop]

@Robert you may be right.. as his also showed PID=4. I wonder what made him consider closing everything.exe BTW I used to use everything by voidtools, I think I stopped 'cos the index wasn't updating..I recall it reigniting my interest in computers. I might start using it again

[Guney Ozsan]

This worked for me. I feel that this looks like safer than fsutil and TxS functionality as the consequences are pretty vague. Any ideas on this?

[kapsiR]

Thanks. I put the hard drive offline and then immediately online again. (diskmgmt.msc) I could remove it then.

[spiralofhope]

fsutil resource stop E: worked for me. Thanks!