VeraCrypt - Free Open source disk encryption with strong security for the Paranoid

Documentation Normal Unmount vs Force Unmount

# Normal Unmount vs Force Unmount

Understanding the distinction between "Normal Unmount" and "Force Unmount" operation is important due to the potential impact on user data.

## Normal Unmount Process

During a normal unmount process, VeraCrypt performs the following steps:

1. Requests the Windows operating system to lock the volume, prohibiting further I/O operations.
2. Requests Windows to gracefully eject the volume from the system. This step is analogous to user-initiated device ejection via the system tray.
3. Instructs the Windows Mount Manager to unmount the volume.
4. Deletes the link between the drive letter and the volume's virtual device.
5. Deletes the volume's virtual device, which includes erasing the encryption keys from RAM.

In this flow, steps 1 and 2 may fail if there are open files on the volume. Notably, even if all user applications accessing files on the volume are closed, Windows might still keep the files open until the I/O cache is completely flushed.

## Force Unmount Process

The Force Unmount process is distinct but largely similar to the Normal Unmount. It essentially follows the same steps but disregards any failures that might occur during steps 1 and 2, and carries on with the rest of the procedure. However, if there are files open by the user or if the volume I/O cache has not yet been flushed, this could result in potential data loss. This situation parallels forcibly removing a USB device from your computer while Windows is still indicating its active usage.

Provided all applications using files on the mounted volume have been successfully closed and the I/O cache is fully flushed, neither data loss nor data/filesystem corruption should occur when executing a 'force unmount'. As in a normal unmount, the encryption keys are erased from RAM upon successful completion of a 'Force Unmount'.

## How to Trigger Force Unmount

There are three approaches to trigger a force unmount in VeraCrypt:

1. Through the popup window that appears if a normal unmount attempt is unsuccessful.
2. Via Preferences, by checking the "force auto-unmount" option in the "Auto-Unmount" section.
3. Using the command line, by incorporating the /force or /f switch along with the /u or /unmount switch.

In order to avoid inadvertent data loss or corruption, always ensure to follow suitable precautions when unmounting a VeraCrypt volume. This includes

1. Ensuring all files on the volume are closed before initiating a unmount.
2. Allowing some time after closing all files to ensure Windows has completely flushed the I/O cache.
3. Take note that some antivirus software may keep file handles open on the volume after performing a scan, hindering a successful Normal Unmount. If you experience this issue, you might consider excluding the VeraCrypt volume from your antivirus scans. Alternatively, consult with your antivirus software provider to understand how their product interacts with VeraCrypt volumes and how to ensure it doesn't retain open file handles.