• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 687
  • Last Modified:

Utility in windows to determine what program is holding a usb drive?

Occasionally in windows when I go to shutdown a usb drive so I can disconnect it, I'll get the message that a program is using the drive even though it appears that all of the foreground programs are not using it. Is there a utility I can run that will show me specifically which process is using a usb drive?
0
opike
Asked:
opike
  • 4
  • 2
  • 2
  • +3
1 Solution
 
arweeksCommented:
0
 
athomsfereCommented:
What version of Windows?

Vista and 7 do have some built in tools, there are also free tools from systernals Process explorer to see exactly what is accessing what, and where. It is free and a great app!

http://download.cnet.com/Process-Explorer/3000-2094_4-10223605.html
0
 
opikeAuthor Commented:
It's windows 7 home ed. I downloaded filemon and try messing around with the filters but it seems to show all the activity on the C: drive (the usb drive is F:). The columns can't be sorted so it makes it a little challenging to easily see what activity is occuring on a certain drive.



filemon.png
0
Worried about phishing attacks?

90% of attacks start with a phish. It’s critical that IT admins and MSSPs have the right security in place to protect their end users from these phishing attacks. Check out our latest feature brief for tips and tricks to keep your employees off a hackers line!

 
arweeksCommented:
Add a filter - image path contains e:

or whatever drive you want to monitor is
0
 
opikeAuthor Commented:
I also took a look at process explorer but I wasn't able to find where you could display what files a pariticular process might be accessing. I looked at the display columns to choose from but didn't see one that was applicable.
0
 
opikeAuthor Commented:
Image path is the path to the executable, not the file that is opened. The usb drive doesn't actually have any executables on it.
0
 
athomsfereCommented:
OK< using process monitor:

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

Sort by drive in the process main page. See your drive in access?

If not go to Tools -> File summary

You can now look By folder, see any open files on that drive?
0
 
nobusCommented:
you could use safely remove :  http://safelyremove.com/?pid=1
0
 
opikeAuthor Commented:
I found this tool to be the most useful (although it isn't free...).
0
 
nobusCommented:
i agree - i have it myself; and you can even get support from the makers..
0
 
Ravi AgrawalCommented:
Although the Q is closed,

I'd like to add that it is possible to see the drive being used by which process using "process explorer"

Start Process Explorer >> Find >> Find Handle or DLL >> e:  -- assuming e: to be the drive letter associated with the USB drive.

Most of the times it is the "System Restore Process" that is accessing the System Volume Information Folder on the USB Drive.

Turn off System Restore on the USB Drive with the drive connected in your System. Windows + Break key >> System Restore tab >> Select the USB drive >> click the settings button >> Put a Check Mark on "Turn off system restore on this drive". Ok out everything. Thats it.

Windows + Break key combo will open the System Properties Window, same as Control Panel >> System.

There's a chance that you won't be faced with this problem anymore unless due to some malware infection.

Ravi.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Worried about phishing attacks?

90% of attacks start with a phish. It’s critical that IT admins and MSSPs have the right security in place to protect their end users from these phishing attacks. Check out our latest feature brief for tips and tricks to keep your employees off a hackers line!

  • 4
  • 2
  • 2
  • +3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now