External hard drive can't be removed

[AllOnTheBus]

Hello all

I have previously started a thread asking a question about
why external drives cannot be safely removed due to being either
in use by another process or wording similar to this.

I have now searched this forum for any previous threads relating to this problem, and also at other forums without any definitive answer as to a solution. I was previously told about a program called LockHunter which
I have used to identify the system processes which stop the drive from being able to be removed. Unfortunately, the tools within the program cannot solve the problem as shown in the screenshot below:

View attachment 187300

I have searched around for a few hours trying to find a solution to this problem to no avail.

Does anyone know of a definitive solution that they could outline step by step here or is this another bug in Windows that they have deemed to hard to patch and therefore placed the topic in the too hard basket?

Ty in advance for replies

Just thought I would add that I just checked the security of my external drive. This is unrelated to the previous question, but does anyone know why there would be an SID
(EG: S-1-5-21 ETC ETC) named as the owner of my external drive? I have just put about 600GB worth of backup on this and prior to that it was unused.

I understand that SID's can be remnants from having the drive plugged in to other machines, however the same SID which appears if I look at the owner of the root drive letter does not also appear in the first screen in the security tab under group or user names. I have always been useless when it comes to setting permissions and how they work - could anyone explain to me what is going on here please?

 

[badger906]

as the wise Linus from "linus tech tips" once said "lifes to short to saftley remove"

 

[AllOnTheBus]

Life is short I will agree with that.

Really not a helpful post though as you are probably aware.

 

[MilesAhead]

Life is short I will agree with that.

Really not a helpful post though as you are probably aware.

I could only get my USB drives to safely remove about 20% of the time. I changed the setting for them in Device Manager to Hot Plug. I use sync.exe from SysInternals:
Sync

to make sure disk data is flushed to the drive before I shut off my USB docks or unplug my USB key. Haven't had any issues.

afa the permission thing, this post may or may not fix it up:

http://www.sevenforums.com/general-discussion/196509-file-permissions-mystery.html#post1651236

edit: I realize sync.exe was last updated in 2006. But on NT based systems like XP, Vista, W7, all it does is lock the volume, then unlock it. The OS automatically flushes all disk buffers when a volume is locked. So it's something that's likely to work fine for a long time.

 

[whs]

Some processes have this habit of not releasing the handles. That does not mean that the drive cannot be removed. The "safely remove" function is there to prevent write operations in process to be prematurely terminated. And that is only significant, if the device was set to allow write caching.

But if the last write operation to the device has been a few seconds ago, it is very unlikely that there is still data "in transfer".

If you want to be 100% sure that the device can be removed, do a reboot. That will terminate all writes and release all handles.

 

[carwiz]

Those are part of the NT file system and normally of no concern to the user. I suspect Windows was terminated or the drive unplugged during a write. Or possibly a driver failure. Windows automatically saves backup of the metadata files and automatically restores them so with these staying open seems to indicate the backup is also hosed. The SID is one of Windows' global IDs. Windows is the owner of the metadata files.

If you can read the disk, I would try to backup it up and run chkdsk. Some of the files may be lost already though.

 

[Maguscreed]

Reboot, if that doesn't work reboot safe mode.
If you can shut off you can just remove it then.

 

[carwiz]

You can't just remove Windows NTFS. The disk will need to be repaired or formated.

 

[MilesAhead]

You can't just remove Windows NTFS. The disk will need to be repaired or formated.

I do it multiple times daily. Set the drive in device manager to hot plug rather than write caching. Run sync.exe. Press the button(in the case of a USB dock) or pull out the key drive.

If I waited for safely remove to work I'd never be able to do anything.

edit:
As WHS said, wait for file operations to complete. Obviously you don't yank the drive out while you're coping a file on. I run sync just to make sure the buffers are flushed. Now and then I'll see the access light give a flicker after I run it. It's just a precaution.

 

[whs]

If I waited for safely remove to work I'd never be able to do anything.

LOL, real life meets theory.

 

[MilesAhead]

If I waited for safely remove to work I'd never be able to do anything.

LOL, real life meets theory.

Heh heh. I know what you mean.

 

[carwiz]

I wasn't talking about hot swap nor were you as I understand your statement. You said to DELETE the metadata files. You can't and still have a readable drive.

 

[MilesAhead]

I wasn't talking about hot swap nor were you as I understand your statement. You said to DELETE the metadata files. You can't and still have a readable drive.

1) It's hard to know what you're talking about since you don't quote anything. Floating statements are ambiguous.

2) I didn't say to delete anything. I posted a link to a thread I thought may be related. You stating otherwise is disingenuous.

 

[badger906]

My point about lifes to short, also implied I never saftley remove drives.

Like on my server I've got hot swap drives, which I just pull out, and I've also got USB drives connected, if need be I just pull them out with no ill effect.

On a mac on the other hand if you do that you get a big angry message from the apple worm inside telling you off! And then half the time you need to restart before it will recognise the device again lol

 

[AllOnTheBus]

Ty for the helpful replies

Just a couple of notes - the devices policy is already set for quick removal and therefore
write caching is disabled. I understand that with this being the case it is probably not
critical if the drive is yanked without safely remove permission so long as I know there
is nothing writing to it and the indicator light is not flashing off its head suggesting that
it is busy.

Now for a couple more questions if you would be so kind:
With the statement I have made above about the devices policy being set for safe removal,
does this mean that the device is "Hot plug"? I don't fully understand the term unless it refers
to the same thing as Plug and Play ie: meaning that USB devices such as mice, keyboards and
the discussed external hard drives can be referred to as either "Hot Plug" or PnP devices- is this correct?

Miles: thanks for the linkout to sync. I am not fully aware of how this works so I have a couple of quetions.

1) Is Sync only operable through command line or is there a GUI (I'll assume command line only seeing as though there only seem to be 2 commands)

2) If it does only work through command line would I really only need to use the command as follows to remove the device: sync -e g:\ then hit enter (is this entering the command correctly?)

The -r option for sync flushes the drive cache if I am to understand correctly, however as you have stated in your edit at post #4, the OS does this automatically anyway meaning that I would not need to run that command- is that right?

I came across an article which stated not to go messing with the cache flushing for anything unless you are looking for a problem to fix. You can find it here:
Windows + Write Cache + Flushing - Emuforums.com
So I guess I need to leave that well alone by the sound of it.

carwiz: you may be correct in regard to how the errors if we refer to them as that got there
in the first place. All the data (as stated previously about 600GB) has been transferred from an Iomega
1TB external drive onto a 1TB WD external drive. I used to yank the plug on the Iomega constantly in disgust due to it freezing up all the time, hence as you said this could be due to the drive being pulled during a write. Will do a chkdsk command on the drive now in use to see if I get any results.

I'm still unsure about the whole SID thing however if Windows owns it I have nothing to worry about then really do I? Just a quick note on this though, the SID that I am referring to appears only on the external drive and not in the Windows registry under HKEY_USERS - again I ask, is that normal?

I don't know if I panic to much or am just interested in trying to know as much as I possibly can about my system, but thankyou again for your responses and in advance for any replies I may get in regard to my latest questions.

Cheers