I believe it's sometimes possible (when lsof and friends can't figure out who's got a particular device or mount point busy) to find the culprit with an approach something like this: find /proc/[0-9]* | xargs -l20 ls -aFdl 2>/dev/null | grep itemOfInterest