opike
asked on
Utility in windows to determine what program is holding a usb drive?
Occasionally in windows when I go to shutdown a usb drive so I can disconnect it, I'll get the message that a program is using the drive even though it appears that all of the foreground programs are not using it. Is there a utility I can run that will show me specifically which process is using a usb drive?
What version of Windows?
Vista and 7 do have some built in tools, there are also free tools from systernals Process explorer to see exactly what is accessing what, and where. It is free and a great app!
http://download.cnet.com/Process-Explorer/3000-2094_4-10223605.html
Vista and 7 do have some built in tools, there are also free tools from systernals Process explorer to see exactly what is accessing what, and where. It is free and a great app!
http://download.cnet.com/Process-Explorer/3000-2094_4-10223605.html
ASKER
It's windows 7 home ed. I downloaded filemon and try messing around with the filters but it seems to show all the activity on the C: drive (the usb drive is F:). The columns can't be sorted so it makes it a little challenging to easily see what activity is occuring on a certain drive.
filemon.png
filemon.png
Add a filter - image path contains e:
or whatever drive you want to monitor is
or whatever drive you want to monitor is
ASKER
I also took a look at process explorer but I wasn't able to find where you could display what files a pariticular process might be accessing. I looked at the display columns to choose from but didn't see one that was applicable.
ASKER
Image path is the path to the executable, not the file that is opened. The usb drive doesn't actually have any executables on it.
OK< using process monitor:
http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx
Sort by drive in the process main page. See your drive in access?
If not go to Tools -> File summary
You can now look By folder, see any open files on that drive?
http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx
Sort by drive in the process main page. See your drive in access?
If not go to Tools -> File summary
You can now look By folder, see any open files on that drive?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I found this tool to be the most useful (although it isn't free...).
i agree - i have it myself; and you can even get support from the makers..
Although the Q is closed,
I'd like to add that it is possible to see the drive being used by which process using "process explorer"
Start Process Explorer >> Find >> Find Handle or DLL >> e: -- assuming e: to be the drive letter associated with the USB drive.
Most of the times it is the "System Restore Process" that is accessing the System Volume Information Folder on the USB Drive.
Turn off System Restore on the USB Drive with the drive connected in your System. Windows + Break key >> System Restore tab >> Select the USB drive >> click the settings button >> Put a Check Mark on "Turn off system restore on this drive". Ok out everything. Thats it.
Windows + Break key combo will open the System Properties Window, same as Control Panel >> System.
There's a chance that you won't be faced with this problem anymore unless due to some malware infection.
Ravi.
I'd like to add that it is possible to see the drive being used by which process using "process explorer"
Start Process Explorer >> Find >> Find Handle or DLL >> e: -- assuming e: to be the drive letter associated with the USB drive.
Most of the times it is the "System Restore Process" that is accessing the System Volume Information Folder on the USB Drive.
Turn off System Restore on the USB Drive with the drive connected in your System. Windows + Break key >> System Restore tab >> Select the USB drive >> click the settings button >> Put a Check Mark on "Turn off system restore on this drive". Ok out everything. Thats it.
Windows + Break key combo will open the System Properties Window, same as Control Panel >> System.
There's a chance that you won't be faced with this problem anymore unless due to some malware infection.
Ravi.
http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx