On OS X there are these moments when Finder tells you that the trash cannot be emptied or that a disk can not be unmounted because some files in/on them are still being used. When emptying the trash, Finder even tells you about the files in question but not about the app that is accessing them.
There are two ways to find out:
With opensnoop you can display what files are currently being accessed (as in live) including the process id and the name of the application. Either you can display all the files or just the one you are interested in.
For example I have an image on my desktop. I can attach to that file and when I open it via double click in Finder I get the following output:
sudo opensnoop -f /Users/hukl/Desktop/IMG_0434.JPG Password: UID PID COMM FD PATH 501 10244 Finder 9 /Users/hukl/Desktop/IMG_0434.JPG 501 32 mds 15 /Users/hukl/Desktop/IMG_0434.JPG 501 10278 Preview 6 /Users/hukl/Desktop/IMG_0434.JPG 501 10278 Preview 6 /Users/hukl/Desktop/IMG_0434.JPG 501 10278 Preview 7 /Users/hukl/Desktop/IMG_0434.JPG 501 10278 Preview 8 /Users/hukl/Desktop/IMG_0434.JPG 501 32 mds 15 /Users/hukl/Desktop/IMG_0434.JPG 501 10278 Preview 6 /Users/hukl/Desktop/IMG_0434.JPG
This only helps though if the file is being actively accessed. More often though an application only holds a reference to the file, preventing Finder to delete it. In this case opensnoop is no good but luckily there is another way:
lsof basically lists information about all files opened by applications. Therefore if I want to know why I can’t delete this image I just opened I can run:
lsof | grep /Users/hukl/Desktop/IMG_0434.JPG Preview 10278 hukl 8r REG 14,5 1584476 483868 /Users/hukl/Desktop/IMG_0434.JPG
Now that I know that Preview.app is still accessing the File I can kill the process and delete the file.
Many times its Finder itself still holding references to the files even if all the applications are closed and there is no apparent reason for not deleting the file. In this case option-click on the Finder icon in the dock and relaunch Finder (you can also kill it in Terminal of course). The files should be deletable and the disks should be unmountable.