0

I am having trouble with the time-honored problem of ejecting 2 external hard drives (Seagate). Windows tells me that both of them have files in use. Handle shows me the following:

PS blarg> handle64.exe -a -nobanner E:\
System             pid: 4      type: File          45C0: E:\$Extend\$RmMetadata\$TxfLog\$TxfLogContainer00000000000000000001
System             pid: 4      type: File          4B30: E:\$Extend\$RmMetadata\$Txf
System             pid: 4      type: File          C77C: E:\$Extend\$RmMetadata\$TxfLog\$TxfLog.blf
System             pid: 4      type: File          CF2C: E:\$Extend\$RmMetadata\$TxfLog\$TxfLogContainer00000000000000000002
svchost.exe        pid: 5584   type: File           270: E:\$Extend\$ObjId:$O:$INDEX_ALLOCATION
svchost.exe        pid: 5584   type: File           29C: E:\System Volume Information\tracking.log

PS blarg> handle64.exe -a -nobanner I:\
System             pid: 4      type: File           488: I:\$Extend\$RmMetadata\$TxfLog\$TxfLog.blf
System             pid: 4      type: File          B8D4: I:\$Extend\$RmMetadata\$TxfLog\$TxfLogContainer00000000000000000002
System             pid: 4      type: File          C2A8: I:\$Extend\$RmMetadata\$Txf
System             pid: 4      type: File          D19C: I:\$Extend\$RmMetadata\$TxfLog\$TxfLogContainer00000000000000000001
svchost.exe        pid: 5584   type: File           1D0: I:\$Extend\$ObjId:$O:$INDEX_ALLOCATION
svchost.exe        pid: 5584   type: File           2B4: I:\System Volume Information\tracking.log

Obviously shutting down the machine works but is annoying. I've tried closing everything in my system tray and turning off Windows Defender. I've tried looking for updated drive firmware but there doesn't seem to be any. Best I can tell the drives are not shared with the network. I've looked at various threads but there is a lot of noise. I've confirmed these drives aren't listed in my Start menu search indexable location. I'm in the process of turning off the checkbox Right Click -> General -> Allow files on this drive to have contents indexed in addition to file properties, and we'll see if that matters...

I've noticed both of the drives have the following setting:

enter image description here

One forum post I found seemed to believe that with this setting, it makes sense that "Safely Remove Hardware" would give issues, since you don't need to use it with this setting. The answer would be to either use "Better Performance" & "Safely Remove..." OR use "Quick removal" & don't use "Safely Remove...". While that does sort of match the description above, that doesn't seem right to me. With my current setting, doesn't the failure message indicate that, despite the above setting, something is indeed using the drive?

Any ideas what that might be? It looks like some sort of system file system management process to me, but I haven't seen anything conclusive.

xdhmoore
  • 625
  • 1
  • 7
  • 25
  • See this page>>>>https://support.microsoft.com/en-us/help/555665 – Moab Aug 30 '20 at 21:43
  • Link for process explorer is broken in the link, here is the new one>>>>https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer – Moab Aug 30 '20 at 21:45
  • I'm aware of this option, but can I really just randomly close handles without consequence? I was hoping to determine what the handle was being used for at least... – xdhmoore Aug 30 '20 at 21:45
  • appears that using performance mode causes this, read the SU link I posted. – Moab Aug 30 '20 at 21:48
  • Well, the claim I saw was that using "Quick Mode" and "Safely Remove", causes it, which I don't see any docs for, but I do think this question is a duplicate of the one you posted... – xdhmoore Aug 30 '20 at 21:59
  • "However, I actually tried switching this drive to "high performance mode" and .. it caused the TxfLogContainerXXXX handles to evaporate. So, it's true that this is the quick-removal option. However, this did not released my drive yet. Still couldn't eject it. Then I have went to ComputerManagement->DriveManagement utility and I have removed any drive-letter assignements for that drive. Instantly afterwards, I was able to eject the drive. Then I tried connecting it again, reassigning the drive letter, switching it to quick-removal and it seems to work properly and still be ejectable." – Moab Aug 30 '20 at 22:36
  • Yeah maybe the association of those handles with Quick Remove mode is indicative that they can be ignored, since that’s the whole point of Quick Remove mode. The drive letter thing seems to me like just another force eject. Doesn’t really give any more info on what those handles are. but idk. – xdhmoore Aug 31 '20 at 00:57
  • I added an answer on that other question. – xdhmoore Aug 31 '20 at 00:59
  • Maybe [LockHunter](https://lockhunter.com/) can help you unlock the drive – xypha Aug 31 '20 at 04:35
  • I guess I didn’t clarify this but my goal is not to unlock the drive (there are several “force eject options”) but to determine what is causing the problem. It happens often. – xdhmoore Aug 31 '20 at 05:13

0 Answers0