Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 684
  • Last Modified:

Utility in windows to determine what program is holding a usb drive?

Occasionally in windows when I go to shutdown a usb drive so I can disconnect it, I'll get the message that a program is using the drive even though it appears that all of the foreground programs are not using it. Is there a utility I can run that will show me specifically which process is using a usb drive?
0
opike
Asked:
opike
  • 4
  • 2
  • 2
  • +3
1 Solution
 
arweeksCommented:
0
 
athomsfereCommented:
What version of Windows?

Vista and 7 do have some built in tools, there are also free tools from systernals Process explorer to see exactly what is accessing what, and where. It is free and a great app!

http://download.cnet.com/Process-Explorer/3000-2094_4-10223605.html
0
 
opikeAuthor Commented:
It's windows 7 home ed. I downloaded filemon and try messing around with the filters but it seems to show all the activity on the C: drive (the usb drive is F:). The columns can't be sorted so it makes it a little challenging to easily see what activity is occuring on a certain drive.



filemon.png
0
Enhanced Intelligibility Without Cable Clutter

Challenge: The ESA office in Brussels wanted a reliable audio conference system for video conferences. Their requirement - No participant must be left out from the conference and the audio quality must not be compromised.

 
arweeksCommented:
Add a filter - image path contains e:

or whatever drive you want to monitor is
0
 
opikeAuthor Commented:
I also took a look at process explorer but I wasn't able to find where you could display what files a pariticular process might be accessing. I looked at the display columns to choose from but didn't see one that was applicable.
0
 
opikeAuthor Commented:
Image path is the path to the executable, not the file that is opened. The usb drive doesn't actually have any executables on it.
0
 
athomsfereCommented:
OK< using process monitor:

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

Sort by drive in the process main page. See your drive in access?

If not go to Tools -> File summary

You can now look By folder, see any open files on that drive?
0
 
madunixChief Information Security Officer Commented:
0
 
nobusCommented:
you could use safely remove :  http://safelyremove.com/?pid=1
0
 
opikeAuthor Commented:
I found this tool to be the most useful (although it isn't free...).
0
 
nobusCommented:
i agree - i have it myself; and you can even get support from the makers..
0
 
Ravi AgrawalCommented:
Although the Q is closed,

I'd like to add that it is possible to see the drive being used by which process using "process explorer"

Start Process Explorer >> Find >> Find Handle or DLL >> e:  -- assuming e: to be the drive letter associated with the USB drive.

Most of the times it is the "System Restore Process" that is accessing the System Volume Information Folder on the USB Drive.

Turn off System Restore on the USB Drive with the drive connected in your System. Windows + Break key >> System Restore tab >> Select the USB drive >> click the settings button >> Put a Check Mark on "Turn off system restore on this drive". Ok out everything. Thats it.

Windows + Break key combo will open the System Properties Window, same as Control Panel >> System.

There's a chance that you won't be faced with this problem anymore unless due to some malware infection.

Ravi.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 4
  • 2
  • 2
  • +3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now