If you boot your Macintosh from one volume and cannot unmount another volume, it is because the other volume has open files on it. You can use the "lsof" command to find the open files on a volume that does not unmount or eject. To do this, open Terminal (typically located in /Applications/Utilities) and type:
sudo lsof | grep
Leave a space after the "p" in "grep". Then drag the icon of the volume on which you want to locate the open files to the Terminal window. The pathname for the volume is pasted into the window for you. Press the Return key. Then, at the prompt, enter your administrator password and press Return.
Finding unexpected open files is frequently a problem with cloned volumes.
If the Macintosh is booted from an eDrive and the startup items copied to the eDrive are causing files to be open on the volume that served as the Mac OS X Source Volume, try logging in as another user, rather than attempting to find the open files and then the processes that have them open.
Each line of the output of the lsof command refers to one open file. The name of the process that has the file open is at the start of the line, and the complete pathname of the file is at the end.
Here is part of an earlier thread on this topic. The output of the lsof command in the following example consists of these three lines:
coreservi 68 root 10u VREG 14,32 5632 54 /Volumes/Maxtor_BU09/Desktop DB
coreservi 68 root 11u VREG 14,32 38082 55 /Volumes/Maxtor_BU09/Desktop DF
RetroRun 26448 root 25u VREG 14,32 214780244 11347 /Volumes/Maxtor_BU09/Main Backup/Maxtor_BU09.cat
You can ignore any references to DesktopDB and DesktopDF; the operating system can close them.
In the example above, the process named RetroRun shown on the last line (a process used by the Retrospect backup program) has a file named Maxtor_BU09.cat open on the volume Maxtor_BU09. The file is in a folder named Main Backup. The user quit Retrospect (either in the Finder or by using Activity Monitor, located in /Applications/Utilities) and the volume was then able to be unmounted.
Spotlight indexing can cause files to be open:
Spotlight consists of two processes, according to Bombich Forums moderator Andreas:
mdimport user process
mds root process
You can turn off Spotlight for the volume you wish to unmount by opening Spotlight's System Preferences, and dragging the icon of the volume to the Privacy pane, which excludes that volume from Spotlight.
When looking at the files that are open on the volume you wish to unmount, concentrate first on processes that are owned by you rather than root (Activity Monitor shows in the "user" field the short user name for the current administrative user rather than "root"). Once the processes owned by you no longer have files open on the volume, you should should be able to unmount it. There may be some exceptions to this rule-of-thumb, cases in which processes are owned by root but launched because the user launched an application (such as the RetroRun process in the example above, which launched because the user launched the Retrospect application program).
Any process that is launched by launchd will relaunch if you hesitate between quitting the process and unmounting the volume on which the process was running. Launchd is Apple's method of launching processes at login, and is supposed to make sure that the processes it controls are promptly relaunched if they quit or crash. For example, if you use Activity Monitor to inspect SystemUIServer, you see that its parent process (the one that launched it) is launchd.
