Why does my Mac say the disk is in use when nothing is open?

Background processes hold files without windows: Spotlight indexing (mds), QuickLook previews, Time Machine, antivirus scanners — even a Terminal window whose working directory is on the volume. Something almost always has a file handle open; macOS just doesn't say what.

Is it safe to force-eject a drive on a Mac?

Force-eject is safe when nothing is actively writing — it closes read handles and unmounts. If a write is in progress you risk truncated files, so identify the process first when you can, and force-eject as the deliberate fallback, not the reflex.

What is the Terminal command to see what's using a drive?

lsof +D /Volumes/YourDrive lists every process with an open file under that volume. Add sudo to see other users' processes, including system daemons.

Which app is using my drive? Finding what blocks eject on a Mac

MountDock Tips · 2026-07-15

The most infuriating dialog in macOS might be this one: “The disk wasn’t ejected because one or more programs may be using it.” Which programs? macOS knows — it just doesn’t say. Here are three ways to get the name, from most manual to least.

1. Terminal: `lsof` tells the whole truth

Open Terminal and run:

lsof +D /Volumes/YourDrive

Every process holding a file anywhere under the volume appears, one line per open file. The first column is the app or daemon name; quit it (or close the file) and eject normally. Two refinements worth knowing:

sudo lsof +D /Volumes/YourDrive shows every user’s processes — necessary when the holder is a system daemon.
If the command itself is slow, the volume is big — +D walks the whole directory tree. Patience, or method 3.

2. Activity Monitor: for the Terminal-averse

Open Activity Monitor, press ⌘F, and search for the volume’s name. Processes with open files on the drive often surface in the search results’ open-files listing. It’s hit-and-miss compared to lsof— but it’s clickable.

The usual suspects

When “nothing is open” but the eject still fails, it’s almost always one of these:

Spotlight (mds, mdworker) — indexing the drive you just plugged in. Give it a minute, or exclude the volume in System Settings → Spotlight.
QuickLook — previewed a file once; the preview service kept the handle.
Time Machine — mid-snapshot to or from the volume.
Antivirus / backup agents — scanning everything new by design.
A Terminal window whose working directory is on the volume. cd ~ and try again — this one catches developers weekly.

Force-eject: the deliberate fallback

When the holder won’t quit — or won’t reveal itself — macOS can force the unmount:

diskutil unmount force /Volumes/YourDrive

This closes read handles safely; the risk is only to files being written at that moment. So: check for active copies first, then force with a clear conscience. Don’t make it the reflex — make it the informed last step.

3. The one-click version

MountDock does this whole page in one gesture: when a volume refuses to eject, it names the app holding it right in the dialog and offers a safe force-eject beneath. No Terminal, no detective work — the answer macOS had all along, finally on screen. Free 14-day trial, $14.99 once, no subscription.