How to Find What Process Is Using a File on Mac

You try to delete a file, empty the Trash or eject a drive and macOS says the item is in use, but not by whom. Something has it open. Here is how to find it.

Find the process with lsof

For a single file:

lsof /path/to/file

For a folder, including everything inside it (this can be slow on big folders):

lsof +D /path/to/folder

Example output:

COMMAND    PID  USER   FD   TYPE  NAME
Docker   18432 mohit   23u  REG   /Users/mohit/data.db
sqlite3  20311 mohit    4r  REG   /Users/mohit/data.db

COMMAND and PID identify the process. The FD column tells you how it holds the path.

Reading the FD column

A drive that will not eject

Ask lsof about the whole volume:

lsof /Volumes/MyDrive

When you give lsof a mount point it lists every open file on that volume, which is faster than +D. Typical culprits are Spotlight indexing the drive, a Terminal tab whose working directory is on it (cd out of it), Preview, Photos or a backup tool.

Other users’ processes

lsof only shows your own processes. For others, such as system services, use sudo lsof /path/to/file.

Without Terminal: Activity Monitor

Select a process in Activity Monitor, click the ⓘ (Inspect) button and open the Open Files and Ports tab. That works when you already suspect a process, but not when you want to ask “who has this file?”.

Releasing the file

1. Quit the app normally first. That is almost always enough.
2. If it will not quit, ask it to stop with kill <PID>, which sends SIGTERM and lets it clean up.
3. Use kill -9 only as a last resort: it cannot save state, and a stale PID may by now belong to a different process. See how MacPeek checks before it kills.
4. Run lsof again to confirm nothing holds the file.

Tip

If the holder is a Terminal session or editor, closing the window or cd-ing elsewhere releases a folder without killing anything.