everyday mac tools

"The disk wasn't ejected because one or more programs may be using it"

· 7 min read

When a Mac says “The disk wasn’t ejected because one or more programs may be using it,” something still has a file open on that drive, or is reading from it. macOS refuses to eject so nothing gets cut off mid-write. Quit the apps that opened files from the drive and try Eject again. If that doesn’t work, one command names the program that’s holding the drive.

What the message means

Ejecting is more than unplugging. macOS has to write out anything still waiting in memory and then unmount the volume, and it won’t unmount while a program still holds a file there. Only that program can let go, so the Mac stops and tells you.

The alert gives you two ways forward: “You can try to eject the disk again or click Force Eject to eject it immediately.” The button reads “Force Eject…”, and clicking it brings up one more check, “Ejecting the disk might cause problems with the disk or the information on it.” Don’t click it yet. Whether forcing is harmless depends on who the holder is.

When macOS knows more, the alert says so, and each version points at a different holder:

  • “The disk couldn’t be ejected because the Finder is using it.” Finder is copying, moving or previewing something on the drive. The advice under it is “Stop the Finder action and then try to eject the disk again.”
  • “The disk “NAME” couldn’t be ejected because “APP” is using it.” This one names the app for you, followed by “Quit that application and try to eject the disk again.”
  • “The disk couldn’t be ejected because it is in use.” This one comes with “Eject “NAME” first and then try to eject the disk again”: a disk image opened from the drive is still mounted.
  • “The disk couldn’t be ejected because it is being shared.” File Sharing is serving the drive to another computer.
  • “The disk cannot be ejected because another user (“NAME”) is using it.” Someone else is logged in on the same Mac with a file open there.

Find the program holding the drive

The generic alert names nobody, so ask Terminal. This lists every open file on the drive, along with the program that opened it. Replace NAME with the drive’s name as it appears in Finder:

lsof /Volumes/NAME

If the name has spaces, put the whole path in quotes. The first column, COMMAND, names the program (cut to nine characters, so loginwind is loginwindow), and PID is its process number. The output looks like this (run against this Mac’s startup volume, with -l added so the USER column shows a number instead of a name):

COMMAND     PID     USER   FD   TYPE DEVICE     SIZE/OFF                NODE NAME
loginwind   424      501  cwd    DIR   1,17          704                   2 /

The FD column tells you how it’s holding the drive. cwd means the program’s current working folder is on the drive, and txt means it’s running code from there. A file that’s open for reading or writing shows a number followed by r, w or u.

Without sudo, lsof sees only programs running under your own account. Spotlight’s indexer (mds and mds_stores) and Time Machine (backupd) run as the system, so if the list is empty, or the eject still fails, run the same command with sudo in front:

sudo lsof /Volumes/NAME

It asks for your administrator password (nothing appears as you type) and only reads; it changes nothing on the drive. If even that prints nothing, no program has a file open there any more. Wait a few seconds and try the eject again.

Usual holders and what to do about each

An app with a file open. Any document, photo or video opened from the drive keeps it busy. Quit the app, or close just that file. The alert’s own advice, when it names apps, is to quit them and try again.

Finder. A copy still running, or a folder you have open in a Quick Look preview, counts. Let the copy finish, close the preview window, and try again.

Terminal. A Terminal window whose current folder is on the drive holds it, even when nothing is running. In lsof it shows as cwd against zsh or bash. Type cd ~ in that window, or close it.

Spotlight. A drive you’ve just plugged in gets indexed, and for a while mds or mds_stores shows up in the sudo lsof list (mdworker_shared can show up even without sudo). That’s temporary. Give it a few minutes, or read what mds_stores is doing if it drags on.

Time Machine. If the drive is a backup disk, a backup in progress (backupd, visible with sudo lsof) holds it. Wait for the backup to finish, or choose Skip This Backup from the Time Machine menu.

A disk image. If you opened a disk image stored on the drive, the image is still mounted. Eject it in Finder’s sidebar first, as the alert asks, then eject the drive.

Eject from Terminal

Once you’ve closed the holder, ejecting by command also works:

diskutil eject /Volumes/NAME

In the man page’s terms, the disk’s volumes are unmounted first, and removable media then becomes safe to remove by hand. Without the word force, it fails in the same cases Finder does, so a failure here is useful information, not a different problem.

When Force Eject is safe

Force Eject unmounts the drive even though a program still has files open on it. Anything a program was still writing, or hadn’t saved, can be lost or left half-written. That’s what the confirmation means by “problems with the disk or the information on it.”

It’s reasonable when lsof shows only Spotlight, Quick Look or a preview you’ve already closed. None of your own files was being written, so none is cut off.

Don’t use it when:

  • a copy or backup is in progress,
  • a document from the drive is open with unsaved changes,
  • lsof shows a program writing to the drive,
  • the drive holds the only copy of something you can’t replace. Copy it somewhere else first.

After a forced eject, plug the drive back in when you can, open a few of the files you care about, and run First Aid on it in Disk Utility if anything looks wrong. Pulling the cable without ejecting at all is a different case, covered in the “Disk Not Ejected Properly” notice.

Keep Spotlight off a drive you plug in often

For an archive drive you never need to search, tell Spotlight to leave it alone. In System Settings, open Spotlight, scroll to the bottom, click Search Privacy and add the drive with the plus button. The steps are in keeping private files out of Spotlight search. On older versions of macOS the pane is named differently, but the setting is the same one.

The Mac then stops indexing that drive, so the indexing process stops being a reason it won’t eject. The cost is that nothing on it will turn up in Spotlight searches.

Questions

Why does my external drive say it’s in use when nothing is open? Something you can’t see is usually holding it: a Terminal window sitting in a folder on the drive, a Quick Look preview, Spotlight indexing, or a backup. Run lsof /Volumes/NAME in Terminal and read the COMMAND column. If it shows nothing, run sudo lsof /Volumes/NAME, which also lists system processes such as Spotlight and Time Machine.

Is it safe to just unplug the drive anyway? Not if you can avoid it. Pulling a drive while a program is writing can lose the file it was writing and, on some formats, leave the drive needing repair. Wait for copies to end, or use the steps above to find what’s holding it.

Will Force Eject erase my files? No. It doesn’t delete anything on the drive. The risk is to data that hadn’t finished being written when the drive went away, such as a copy in progress or a document with unsaved changes.

Does restarting the Mac fix it? Yes, because every program lets go of the drive during shutdown, and you can then unplug it once the Mac is off. It’s slower than finding the holder, so keep it as the last resort when nothing else works.