I have a volume mounted by TrueCrypt. All works fine, except when I try to dismount it (after verifying I don't have any application or explorer using anything in it). Every time I click the `Dismount` button, I receive this error:

> 
> Volume contains files or folders being used by applications or system.
>  Force dismount?
> 
> 
> 

![enter image description here](https://i.stack.imgur.com/24Yur.png)

I fired up Sysinternals' Process Monitor, filtered on the path beginning with that drive letter and noticed strange results in which I swear that I have not attempted to access that drive with any of the applications listed (Explorer.EXE, SnippingTool.exe, firefox.exe).

All 3 applications show the same type of "access" (with `SUCCESS` result):

* **CreateFile:**
Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: None, AllocationSize: n/a, OpenResult: Opened
* **QueryNameInformationFile:** Name: \
* **QueryInformationVolume:** VolumeCreationTime: 2/10/2015 10:04:26 PM, VolumeSerialNumber: D753-7E32, SupportsObjects: True, VolumeLabel:
* **QueryAttributeInformationVolume:** FileSystemAttributes: Case Preserved, Case Sensitive, Unicode, ACLs, Compression, Named Streams, EFS, Object IDs, Reparse Points, Sparse Files, Quotas, Transactions, 0x3c00000, MaximumComponentNameLength: 255, FileSystemName: NTFS
* **CloseFile:**
* **CreateFile:** Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Free Space Query, Attributes: n/a, ShareMode: None, AllocationSize: n/a, OpenResult: Opened
* **QueryFullSizeInformationVolume:** TotalAllocationUnits: 4,194,303, CallerAvailableAllocationUnits: 2,425,717, ActualAvailableAllocationUnits: 2,425,717, SectorsPerAllocationUnit: 8, BytesPerSector: 512
* **CloseFile:**

---

I tried disabling indexing for that drive (and all its subfolders and files by *unchecking* the corresponding checkbox on the drive's properties page, but that didn't help.

![enter image description here](https://i.stack.imgur.com/8YXGS.png)

---

The only `ACCESS DENIED` on Process Monitor is shown for TrueCrypt's `FileSystemControl` operation:

> 
> Control: FSCTL\_LOCK\_VOLUME
> 
> 
> 

---

Interestingly, if I mount that drive and immediately dismount it (without attempting to access it via Explorer even once), then it dismounts without any error.

---

The worst part of this problem is that if I go ahead and click `Yes` (force dismount), Windows 8.1 crashes with BSOD (the blue screen of the death). Obviously this doesn't make this tool very useful.

---

Any idea how to get rid of this error message? Disable a Windows service or feature that causes this?