The lsof Command Explained for Mac Users

Your external drive won’t eject. macOS gives you the maddeningly vague message that “one or more programs may be using it.” Which programs? It won’t say. This is where lsof comes in.

The name stands for “list open files,” and it does exactly that. On Unix-based systems like macOS, almost everything is treated as a file, including network connections, devices, and disk volumes. When you can’t eject a drive, lsof tells you precisely which process is holding it hostage.

Basic syntax

The simplest way to use lsof for ejection problems is:

lsof /Volumes/YourDriveName

Replace “YourDriveName” with the actual name of your drive. If the name has spaces, wrap the whole path in quotes:

lsof "/Volumes/My Backup Drive"

This returns a list of every process that has an open file handle on that volume. Each line shows the process name, its ID (PID), the user running it, and information about the specific file being accessed.

Reading the output

A typical lsof output looks something like this:

COMMAND     PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
mds_store  1234   root   4r   REG   1,12   524288  ...  /Volumes/External/.Spotlight-V100/...
Finder     5678   you    3r   DIR   1,12     1024  ...  /Volumes/External

The columns that matter most are COMMAND (the process name), PID (process ID you’d use to kill it), and NAME (the actual file path being accessed).

The FD column shows how the file is being used. A number followed by “r” means read access, “w” means write, and “u” means both read and write. If you see “cwd”, the process has that location as its current working directory. This happens when you have a Terminal window open to a folder on the drive.

Finding out what’s blocking your drive

For ejection problems specifically, you usually just need to know which process names appear. Common culprits include mds and mds_stores (Spotlight indexing), Finder, QuickLookUIService (thumbnail generation), and fsevents (filesystem watcher).

If you see a lot of output and want to narrow it down, you can use grep:

lsof /Volumes/YourDriveName | grep -v "^COMMAND"

This removes the header line so you only see actual processes. If you want just the unique process names:

lsof /Volumes/YourDriveName | awk '{print $1}' | sort -u

Useful flags

The -c flag filters by command name. If you suspect Spotlight is the problem:

lsof -c mds /Volumes/YourDriveName

This shows only processes whose names start with “mds.”

The +D flag recursively lists all open files in a directory:

lsof +D /Volumes/YourDriveName

This is more thorough than the basic syntax but can be slow on large drives with many files.

To see which processes a specific user has open on the drive:

lsof -u yourusername /Volumes/YourDriveName

Using lsof without sudo

By default, lsof only shows processes owned by your user account. System processes run by root (like Spotlight’s mds) won’t appear unless you run lsof with sudo:

sudo lsof /Volumes/YourDriveName

You’ll need to enter your password. For troubleshooting ejection problems, using sudo is almost always necessary since system processes are frequently the blockers.

Killing the blocking process

Once you know the process ID (PID) from the lsof output, you can terminate it:

kill 1234

Replace 1234 with the actual PID. If that doesn’t work, you can force it:

kill -9 1234

Be careful with this. Killing system processes like mds can cause temporary issues. The process will usually restart automatically, but you might see Spotlight behave strangely for a minute. Killing applications like Finder is generally safe; macOS will restart Finder automatically.

For applications you own (like a Terminal window with a shell sitting in the drive’s directory), it’s cleaner to just close the application normally or navigate away from the drive before trying to eject.

Common scenarios

Terminal with current directory on the drive: If you’ve cd’d into a folder on your external drive, that shell process will hold the drive open. Either cd somewhere else (cd ~) or close that Terminal window.

Finder windows: If Finder has a window open to the drive, or even if it has the drive selected in the sidebar, it can prevent ejection. Close any Finder windows showing the drive’s contents.

Spotlight indexing: The mds, mds_stores, and mdworker processes index new drives automatically. You can wait for them to finish, disable indexing with sudo mdutil -i off /Volumes/YourDriveName, or kill them directly.

Background apps with files open: Some applications keep recent files referenced even after you’ve closed the documents. Creative applications like Photoshop or video editors are common offenders. Quitting the app entirely usually releases the files.

Beyond the command line

If you’re not comfortable with Terminal or don’t want to puzzle through lsof output every time you need to unplug a drive, there are graphical options.

Activity Monitor can show you open files for a specific process, but you have to already know which process to inspect. It doesn’t easily answer “what’s using this drive?”

Ejecta was built specifically for this problem. It shows your connected drives, identifies which processes are blocking each one, and lets you quit those processes with one click. It’s essentially a GUI wrapper around the detective work that lsof requires, plus the intelligence to handle system processes safely.

The command line is powerful for those who prefer it, but it shouldn’t be mandatory for something as simple as unplugging a drive.