Unable to unmount/eject a virtual drive - what is withholding it?

When unmounting a virtual drive I sometimes get a warning reading as follows
"
There are currently files opened on N:\: or shell windows from that logical device. If you do not close the files before dismounting from the logical device, data may be lost.Do you want to dismount the device anyway?
"
I used Process Explorer > Find > Find Handle or DLL Substring, then entered the drive-letter, like X:
but there are no hits.

Any suggestions what else to use so as to figure out what is withholding ejecting the drive.
Note: It is not VHD(X)

Thanks.

(Windows 10 x64 1909)

Thanks. I do "File > Exited" all applications. I use a Windows Explorer replacement, Directory Opus and also File->Exited that one. It isn't in the Task Manager list, also not under tab "Details". I also disabled protection (AV software), but still 'some' process seems to access the virtual drive. Don't know of any other tools that may cast some light on this.

tfwul said:

Thanks. I do "File > Exited" all applications. I use a Windows Explorer replacement, Directory Opus and also File->Exited that one. It isn't in the Task Manager list, also not under tab "Details". I also disabled protection (AV software), but still 'some' process seems to access the virtual drive. Don't know of any other tools that may cast some light on this.

Hi there
What Virtual Machine software are you using (Not what HOST you are using). If it's Vmware you can always "release" the usb device by going to the menu (in VMWare) and remove the device that way --it will override any Windows (GUEST VM) hold on the device.

However that's usually an extreme measure as there may well be "latent activity" on the device -- I/O on a VM is not always "committed" at the time the user might "think it has" e.g when copying a large file from the device to the VM (or the other way around).

If you really need the device the best thing is to power off the VM via the shutdown menu. The I/O cache will then be emptied "gracefully".

Cheers
jimbo

Thanks jimbo45.
Please do note it is a virtual drive, i.e. it needs to be mounted, like VeraCrypt, or a VHD(X).
Not VM.
Usually it would be some application still accessing the drive, like Explorer, or a tool like Everything.
But all applications that do have access to the drive are fully exited.

So I assume(..) it could be some kind Windows process(?)
Reason why I tried Process Explorer in the first place.

As said, Process Explorer does not show anything, whereas, if, for instance, Opus would be active, Opus would show up.

Now, in this case, the application offers the option to close anyway.
("Do you want to dismount the device anyway?")

I normally dismount 'anyway', no data is lost.

But ... eh ... I just want to know what it is...

Thanks!

Yes indeed, under "Indexing Options" some folders within the encrypted drive were tagged.
I unchecked them just now, let's see if that helps.
Frankly speaking, I am not sure though whether I need that indexing for some purpose.
I use Everything for searching files and X1 to search within searchable content (Word, Excel, PDF, Outlook, etc)