Question VeraCrypt, volume-dismounting, files or folders being used etc

[Christian1]

Hi

I wonder whether you can help me


Win10 -- build 19044.1526 -- version 21H2

There’s been this problem for quite a while.

I use two external hard drives encrypted with VeraCrypt. The two external hard drives are identical, encrypted the same way, used the same way, same stuff save on them, etc.

Whenever I dismount a particular volume (one of the two external hard drives) VeraCrypt tells me::

“Volume contains files or folders being used by applications or system. Force dismount??”

VeraCrypt doesn’t say (as far as I can see) which files or folders or applications they are.

Task Manager isn’t much help, also because there’s so much data I am sort of lost.

I’ve scanned, with various apps, for viruses, malware, etc, repeatedly, and all is clean.

Is there any way I can find out what is actually happening??


in advance, thank you very much for you kind help

Christian

 

[RLGL]

The VeraCrypt. people can't help? Have you contacted them?

 

[mxnerd]

Guess OP didn't use Windows's USB drive ejection function first?

 

[C1]

Make sure that you enable display of both hidden & system files, then inspect the encrypted drives for existence of any hidden system type files.

Another possibility is to compare the screen dump list from task manager before & after drive dismount in attempt to identify associated tasks/processes when encrypted drives are mounted.

PS: I use VC on a mounted USB external drive with W10 & have not encountered your issue (albeit only a single drive). Intuitively I would guess that the procedure to follow is to dismount the VC drive then perform the USB eject given the physical drive is to be dsconnected, although in one of the computer talks shows I was told that USB eject is not really required when using W10.

 

[mikeymikec]

@Christian1

I concur with @C1 - dismount the encrypted volume in Veracrypt, then USB eject in Windows. Windows doesn't have any control over the Veracrypt encrypted volume, so if you attempt to USB eject a drive that has an unlocked Veracrypt file system on it, Windows would likely complain that something is still accessing that drive.

If you wanted to confirm that this is what's happening then you could check the Windows Event Viewer > Windows Logs > System log for an entry at the time of the attempted USB disconnect and it'll give you a process ID (and name?) of the process responsible for veto'ing the eject command. Often it'll be an unhelpful process like 'System', but I bet that in this case it would be Veracrypt.

I use Veracrypt a lot for fully-automated and semi-automated backup systems and have never once had an issue with dismounting (presumably because I do it in the way that's been advised).