14 Replies Latest reply: Feb 20, 2014 9:01 PM by Phil Stokes
JimMoriarty Level 1 Level 1 (0 points)

Hey Apple Support Communities,

 

I've been told this question has been asked somewhere here before, but I couldn't find it. I have many times been unable to eject an extenal hard drive because OS X tells me that an app that should have no business using the app (such as Safari, Mail, Calendar, etc.) is using it. I've tried closing windows and such, but I can only solve it if I quit out of the app. Has anyone else experienced this, or better yet: does anyone know how to make it stop? This has happened on two of my MacBook Pros (original unibody and retina, both 15") running versions of OS X from Snow Leopard to Mountain Lion. I'm at a loss, and kinda fed up with the stupid glitch/setting that causes this...


MacBook Pro with Retina display, OS X Mountain Lion (10.8.4)
  • Topher Kessler Level 6 Level 6 (9,565 points)

    The only way to clear open files is to quit the corresponding application or have it close and clear the files. Are you purposefully opening files from this drive in these programs?

     

    If it happens again, open the Terminal utility and run the following command:

     

    diskutil list

     

    In the output of this command, make note of the disk identifier for your external drive (something like disk1 or disk2), and then use it in the following command:

     

    sudo lsof /dev/disk1

     

    This will output all the files that are currently open on that drive, and show you what program has them open. If you cannot figure out what the output means, copy and paste the output to a reply here.

  • JimMoriarty Level 1 Level 1 (0 points)

    That's the thing— no files in those applications are open in the drive. Having Safari open to the Top Sites window isn't using a hard drive of Premiere Pro projects... Neither should Calendar or Mail...

  • Topher Kessler Level 6 Level 6 (9,565 points)

    You may not think files are open, but the system and applications will have a number of them open anyway. Did you run the commands to see what items are listed as being opened on the particular device?

  • Phil Stokes Level 2 Level 2 (360 points)

    The simple answer to this problem is to restart your mac.

     

    If it recurs, use lsof in Terminal to find the culprit:

     

    http://hints.macworld.com/article.php?story=20040121001144687

  • Topher Kessler Level 6 Level 6 (9,565 points)

    The problem is that this shouldn't be a necessary step all the time, and its preventing him from ejecting drives on a daily basis. I find it particularly odd that applications like Calendar and Mail would establish file locks on files on this drive.

  • JimMoriarty Level 1 Level 1 (0 points)

    Thank you, yes my issue is that I can't even thin of what would be in use by the said applications. Im not overly proficient in Terminal, and often worry that I'd do more damage in there than good. As I've said, I can have a fairly dormant instance of the application (such as Safari's default "Top Sites" window) and this still occurs. It's been driving me insane for a couple of years, and with my current schedule and need for swapping drives as often as I do, I'm finally at a breaking point.

  • JimMoriarty Level 1 Level 1 (0 points)

    I've tried restarting my Mac, I've often had to bite the bullet and quit out of applications— this just makes swapping drives a lengthy process!

  • Topher Kessler Level 6 Level 6 (9,565 points)

    The Terminal may seem intimidating, but can be very useful. In this case, the first command I mentioned previously lists your attached hard drives:

     

    diskutil list

     

    The output of this will look like a small table, with the right-hand column being a list of device identifiers that will be something like "disk1" or "disk2." For each of these you will see similar ones that end with "s1" "s2" "s3," etc., which represent the various partitions on the drive.

     

    Last login: Tue Jun 11 17:44:52 on ttys001

    Tophers-Laptop:~ tkessler$ diskutil list

    /dev/disk0

       #:                       TYPE NAME                    SIZE       IDENTIFIER

       0:      GUID_partition_scheme                        *500.3 GB   disk0

       1:                        EFI EFI                     209.7 MB   disk0s1

       2:                  Apple_HFS Macintosh HD            499.4 GB   disk0s2

       3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3

    /dev/disk2

       #:                       TYPE NAME                    SIZE       IDENTIFIER

       0:      GUID_partition_scheme                        *1.5 TB     disk2

       1:                        EFI EFI                     209.7 MB   disk2s1

       2:                  Apple_HFS Time Machine Backups    1.5 TB     disk2s2

    /dev/disk3

       #:                       TYPE NAME                    SIZE       IDENTIFIER

       0:     FDisk_partition_scheme                        *7.7 GB     disk3

       1:               Windows_NTFS TEST                    7.7 GB     disk3s1

     

    In the list, you can see the "NAME" column where you can find the name of your external drive, and if you follow over to the right you can see the corresponding identifier for it. For example, here the third device "disk3" has a single partition "disk3s1" which is a Windows NTFS partition that is named TEST.

     

    To list the open files on this drive, you would use the "lsof" command (which means LiSt Open Files), and run it in the following way so it only shows the open files on the drive (you will have to supply your password at the prompt, but as you can see below it does not show when you type it):

     

    sudo lsof /dev/disk3

     

    Last login: Tue Jun 11 20:32:44 on ttys003

    Tophers-Laptop:~ tkessler$ sudo lsof /dev/disk3

    Password:

    Tophers-Laptop:~ tkessler$

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

    In this case, there are no open files since after entering the password the Terminal drops back to the command prompt without listing any files.

     

    In your case, if there are any files listed, select and copy the listing from the Terminal and paste it into a reply here so we can see what they are and what applications are involved with each.

  • unfrostedpoptart Level 1 Level 1 (10 points)

    I get this all the time and it's a massive pain in the neck!  In my case, it's an encrypted disk image.  Like the OP, OSX tells me it can't eject since safari (or mail) is using it.  Those apps should never access any files on that drive.

     

    Also interesting:  I had to wipe my drive and reinstall 10.9 a few weeks ago.  After I did that, I didn't have the problem anymore! 

     

    However, after a couple of weeks of use, it came back!!!

     

    I am proficient in Terminal (longtime Unix/Linux user) and tried the diskutil list (showed it as /dev/disk3) and then lsof /dev/disk2.  This didn't output any files!  Now what?

     

    Davids-MacBook-Pro:~ david$ diskutil list

    /dev/disk0

       #:                       TYPE NAME                    SIZE       IDENTIFIER

       0:      GUID_partition_scheme                        *251.0 GB   disk0

       1:                        EFI EFI                     209.7 MB   disk0s1

       2:                  Apple_HFS david_rMBP_SSD          250.1 GB   disk0s2

       3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3

    /dev/disk1

       #:                       TYPE NAME                    SIZE       IDENTIFIER

       0:     Apple_partition_scheme                        *3.1 GB     disk1

       1:        Apple_partition_map                         32.3 KB    disk1s1

       2:                  Apple_HFS my_data1                2.6 GB     disk1s2

    /dev/disk2

       #:                       TYPE NAME                    SIZE       IDENTIFIER

       0:     Apple_partition_scheme                        *32.2 GB    disk2

       1:        Apple_partition_map                         32.3 KB    disk2s1

       2:                  Apple_HFS my_data2                32.2 GB    disk2s2

     

    Davids-MacBook-Pro:~ david$ sudo lsof /dev/disk2

    Password:

    Davids-MacBook-Pro:~ david$

  • Phil Stokes Level 2 Level 2 (360 points)

    You're not targetting the right partition. Try

     

    lsof /dev/disk2s2

  • unfrostedpoptart Level 1 Level 1 (10 points)

    Thanks.  That shows:

     

      Davids-MacBook-Pro:~ david$ sudo lsof /dev/disk2s2

      COMMAND    PID  USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME

      mds         57  root   17r   DIR    1,9      476      2 /Volumes/_data2_mb_

      mds         57  root   28r   DIR    1,9      476      2 /Volumes/_data2_mb_

      mds         57  root   55r   DIR    1,9      476      2 /Volumes/_data2_mb_

      Safari    6624 david  txt    REG    1,9   407224 278205 /Volumes/_data2_mb_/data2/login.keychain

      Dashboard 8077 david  txt    REG    1,9   407224 278205 /Volumes/_data2_mb_/data2/login.keychain

     

    From what I understand, the mds tasks are part spotlight indexing, which I don't think are an issue (or maybe they are).

     

    I have no clue what Safari and Dashboard are doing accessing keychains on this drive image.  Like I said, I'm good at *nix (awk, vi, emacs, grep, find, xargs, etc) but this is OSX-specific stuff.

     

    So I killed the task:

      kill 6624

      Davids-MacBook-Pro:~ david$ sudo lsof /dev/disk2s2

      COMMAND    PID  USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME

      mds         57  root   28r   DIR    1,9      476      2 /Volumes/_private_mb_

      Dashboard 8077 david  txt    REG    1,9   407224 278205 /Volumes/_private_mb_/private/login.keychain

     

    Now, when I try and eject, I get the same pop-up I would get if I quit Safari:

     

      The disk "_data2_mb_" wasn't ejected because one or more programs may be using it.

      You can try to eject the disk again or click Force Eject to ject it immediately.

     

    So, I try killing the other tasks:

     

      Davids-MacBook-Pro:~ david$ sudo kill -9 57

      Davids-MacBook-Pro:~ david$ sudo lsof /dev/disk2s2

      COMMAND     PID  USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME

      Dashboard  8077 david  txt    REG    1,9   407224 278205 /Volumes/_private_mb_/private/login.keychain

      mds       12497  root    9r   DIR    1,9      476      2 /Volumes/_private_mb_

      mds       12497  root   11r   DIR    1,9      476      2 /Volumes/_private_mb_

      mds       12497  root   13r   DIR    1,9      476      2 /Volumes/_private_mb_

     

    But they come right back and I get the same pop-up.

     

    I have to click OK and get more pop-ups warning the world will end if I force-eject the disk

     

    Like I said, after I re-installed OSX, it didn't do this for a while but eventually came back.

     

     

     

    David

  • Phil Stokes Level 2 Level 2 (360 points)

    Has that flash drive (I'm assuming from the size) got any executable scripts or binaries on it? Did it come with any pre-installed vendor software?

     

    Do

     

    $ls -alF

     

    and take a good hard look through the list. Seems to me something could be running everytime you mount that disk.

     

    Also,  check your login items and make sure there's nothiing in ther that is calling that disk when you log in.

  • unfrostedpoptart Level 1 Level 1 (10 points)

    Phil, thanks for the suggestions.  FYI, it's not a flash. It's an encrypted disk image created in diskutil.

     

    Anyway, I poked around the directories more and did some google searches and found this:

     

    http://blog.hostilefork.com/trashes-fseventsd-and-spotlight-v100/

     

    http://forums.macrumors.com/showthread.php?t=1103654

     

    I tried the suggestions from the first and think it might have fixed the problem.  It might also explain why I didn't have the problem right after re-installing OSX; I didn't start up Time Machine for a couple of weeks and it looks like that's what's been causing the problems.  I'll have to try some more tests but right now lsof doesn't show any tasks associated with the disk and it ejects properly.

  • Phil Stokes Level 2 Level 2 (360 points)

    Cool, hope it stays that way.

     

    I still can't see why Safari and Dashboard would have open files on that volume from those explanations though. They don't appear to have anything to do with either Spotlight or fseventsd.