On OS X there are these moments when Finder tells you that the trash cannot be emptied or that a disk can not be unmounted because some files in/on them are still being used. When emptying the trash, Finder even tells you about the files in question but not about the app that is accessing them.

There are two ways to find out:

1. opensnoop

With opensnoop you can display what files are currently being accessed (as in live) including the process id and the name of the application. Either you can display all the files or just the one you are interested in.

For example I have an image on my desktop. I can attach to that file and when I open it via double click in Finder I get the following output:

sudo opensnoop -f /Users/hukl/Desktop/IMG_0434.JPG 
Password:
  UID    PID COMM          FD PATH                 
  501  10244 Finder         9 /Users/hukl/Desktop/IMG_0434.JPG 
  501     32 mds           15 /Users/hukl/Desktop/IMG_0434.JPG 
  501  10278 Preview        6 /Users/hukl/Desktop/IMG_0434.JPG 
  501  10278 Preview        6 /Users/hukl/Desktop/IMG_0434.JPG 
  501  10278 Preview        7 /Users/hukl/Desktop/IMG_0434.JPG 
  501  10278 Preview        8 /Users/hukl/Desktop/IMG_0434.JPG 
  501     32 mds           15 /Users/hukl/Desktop/IMG_0434.JPG 
  501  10278 Preview        6 /Users/hukl/Desktop/IMG_0434.JPG

This only helps though if the file is being actively accessed. More often though an application only holds a reference to the file, preventing Finder to delete it. In this case opensnoop is no good but luckily there is another way:

2. lsof

lsof basically lists information about all files opened by applications. Therefore if I want to know why I can’t delete this image I just opened I can run:

lsof | grep /Users/hukl/Desktop/IMG_0434.JPG 
Preview   10278 hukl    8r     REG               14,5    1584476 483868 /Users/hukl/Desktop/IMG_0434.JPG

Now that I know that Preview.app is still accessing the File I can kill the process and delete the file.

Many times its Finder itself still holding references to the files even if all the applications are closed and there is no apparent reason for not deleting the file. In this case option-click on the Finder icon in the dock and relaunch Finder (you can also kill it in Terminal of course). The files should be deletable and the disks should be unmountable.