What Happens When You Unmount A Drive Linux?

When you unmount a drive in Linux, the operating system detaches the device's filesystem from the Linux file hierarchy, making it safe to remove physically.

This process is the reverse of mounting, which attaches a device's filesystem to a specific directory, known as a mount point. Unmounting is a critical, multi-step process that involves the kernel synchronizing data, terminating access, and cleaning up internal data structures.

The stages of a successful unmount

1. Request received: The user initiates an unmount, typically with the umount command, specifying the mount point (e.g., /mnt/usb) or the device (e.g., /dev/sdb1). The command line tool then passes the request to the kernel via the umount() or umount2() system call.
2. Activity check: The kernel first checks if the filesystem is "busy." This means it checks if any open files, active processes, or running applications are using the mount point.
   • If busy: The standard umount command will fail with an "EBUSY" error, preventing data corruption.
   • If not busy: The kernel proceeds with the unmount.
3. Synchronization of data: The kernel flushes all pending and cached data from memory to the physical storage device. This ensures that all write operations are completed and the device's data is in a stable, consistent state. Some filesystems also update metadata on the drive to record that it was cleanly unmounted.
4. Resource cleanup: The kernel frees the internal data structures that managed the mounted filesystem. This includes:
   • Dereferencing: Breaking the link between the mount point directory in the main file hierarchy and the root directory of the mounted filesystem.
   • Freeing in-memory structures: Deallocating the superblock and other data structures in the kernel's memory used to manage the filesystem.
   • Releasing resources: Unregistering entries in the system's virtual filesystem (VFS) and releasing filesystem-specific resources.
5. Device detachment: The kernel marks the device as detached and no longer accessible through its mount point. The mount point directory itself is now empty and once again shows its original content, if any.
6. Physical removal: Only after the unmount process is complete is it safe for the user to physically unplug the storage device without risking data loss or corruption.

Handling stubborn or busy mounts

If the filesystem is in use and a standard umount command fails, Linux provides alternative methods with tradeoffs:

• Lazy unmount (umount -l): The filesystem is immediately detached from the file hierarchy, making it invisible to new processes. However, the kernel delays the final cleanup until all active processes finish using the filesystem. This prevents blocking but should be used with care.
• Force unmount (umount -f): This option is a last resort, as it can cause significant data loss. It forces an immediate unmount, killing any processes accessing the filesystem. It should only be used in emergencies, such as when a network filesystem becomes unresponsive, and its use is not supported by many local filesystems like ext4 and btrfs.
• Manual process termination (lsof or fuser): A safer method is to first use tools like lsof (list open files) or fuser to identify and terminate any processes holding the filesystem busy before attempting a normal umount.

The state of the device after unmount

After a successful unmount, the physical device and its filesystem are in a consistent state, with no pending operations. The filesystem is no longer accessible via its old mount point. If the device was a removable one (like a USB drive), it is ready for safe removal. To use it again, it must be remounted. In the case of an external drive, unplugging and replugging it will often cause the system to automatically remount it.