The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

  • Twitter Updates

  • My Flickr Stream

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 2,975 other subscribers

Figuring out which processes are preventing to eject/unmount my MacOS Time Machine backup USB drive

Posted by jpluimers on 2022/03/31

One day, a MacOS Time Machine backup USB drive could not me ejected/unmount.

These links helped me figure out what was wrong via [Wayback] find which macos program prevents unmount – Google Search:

  • [Wayback] macos – The volume can’t be ejected because it’s currently in use – Ask Different (Thanks [Wayback] CousinCocaine, [Wayback] Paul Gilfedder and [Wayback] Alan W. Smith)


    • The volume can’t be ejected because it’s currently in use.
    • The disk “Diskname” wasn’t ejected because one or more programs may be using it.“.
    • umount(/Volumes/Diskname): Resource busy -- try 'diskutil unmount'

    My question: How do I know what program is using my drive so I can properly quit that program and eject my drive?

    The volume can't be ejected because it's currently in use. The disk "Camel" wasn't ejected because one or more programs may be using it. The disk "Mammtoh" wasn't ejected because one or more programs... xkcd


    lsof is indeed your best bet. The fastest and easiest way would be this :-

    sudo lsof /Volumes/myDrive

    It can take a couple minutes to run, but once it’s complete, it gives you a list of open files on the disk. The output will look something like this:

    mds         89  root   19r   DIR   52,3      432     2 /Volumes/Photos
    mds         89  root   23r   DIR   52,3      432     2 /Volumes/Photos
    Finder     681 alans   14r   DIR   52,3      432     2 /Volumes/Photos
    QuickLook 2158 alans    9r   REG   52,3  1141591 78651 /Volumes/Photos/_tmp_iphone_10_backup/APC_1546.JPG  

    In this case, it’s the QuickLook application that has a file open. Closing the application directly is the best way to fix the issue. However, that’s not always possible. For example, QuickLook doesn’t show up as an application you can get to in the Dock.

    If you can’t close the application manually, you can use the kill command to terminate it from the command line. To do that, use the PID from the second column as the ID to kill. From the above example, it would be:

    kill 2158

    Note that sometimes that doesn’t work and a more aggressive form of kill must be used. Here’s a series of escalating aggressiveness (using the example PID of 2158):

    kill 2158
    sudo kill 2158
    sudo kill -INT 2158
    sudo kill -KILL 2158

    You should be able to eject the disk once the process/application has been killed.

    One final note, lsof can take a minute or two. It can also hang, but you should give it at least a few minutes before you decide that’s what happened.

    Also, sometimes the base command sudo lsof /Volumes/myDrive won’t find anything. If that happens, try adding the +D argument (i.e. sudo lsof +D /Volumes/myDrive). That will do a top down scan of the disk. It’ll take longer, but it should pick up anything that’s causing the disk to be un-ejectable.

    (Hat tip to Alec Jacobson’s post for extra details.)


    sudo lsof /Volumes/drive is much faster than sudo lsof | grep /Volumes/drive

  • [Wayback] Find out which application is using external hard drive in order to eject it « Alec’s Web Log
    sudo lsof +D "/Volumes/[name of drive]"

    You can always run the lsof command again to see if the process really died.

    kill [PID of process]
    sudo kill [PID of process]
    sudo kill -INT [PID of process]
    sudo kill -KILL [PID of process]
  • [Wayback] time machine – How do I make Spotlight stop indexing my Backup drive? – Ask Different (thanks [Wayback] hectorpal!)

    I finally found you cannot disable Spotlight to index Backups.backupdb.

    [Wayback] Apple Support. OS X El Capitan: Spotlight preferences

    If you add a Time Machine backup disk to the privacy list, you will continue to see messages that Spotlight is indexing your backup disk. This indexing is necessary for Time Machine to function properly and can’t be disabled. Spotlight does exclude from searches any items you store on your backup disk that are not part of a Time Machine backup.

  • [Wayback] If you can’t eject a disk from Mac – Apple Support

    If you can’t eject an external disk or storage device

    1. On your Mac, choose Apple menu  > Log Out, then log in again. Try to eject the disk again.
    2. If you still can’t eject the disk, choose Apple menu  > Shut Down. Disconnect the disk from your computer, then start up your computer again.

This figured out which processes were involved:

# sudo su -

# lsof +D /Volumes/Samsumg860Evo4TB

The main processes keeping file handles in use on the SSD device where mds and mds_stores (similar as in [Wayback] How to fix: The volume can’t be ejected because it’s currently in use). Killing spotlight did not help, and logoff failed as well: I had to shutdown the whole machine to be able to detach the USB drive.

So it was Spotlight galore all over again, which is odd, as this is a USB3 SSD for which the Time Machine backup had tried to update for more than 12 hours, so Spotlight – if indexing at all – should have been long done.

Spotlight galore:

The final solution was to perform a shutdown of the machine. It had not been for over 3 months, so apparently that caused some confusion for the combination of Spotlight and Time Machine.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: