I have found a strange issue related to hivex/ntfs-3g. After opening a system hive on a volume mounted by ntfs-3g, any access to the Windows directory results device or resource busy error. The patch below fix it by closing the hive file handle in hivex_open() call in the writable path because the handle never been used after its content been read into memory. --- hivex-1.2.5.orig/lib/hivex.c 2011-04-13 06:04:49.000000000 -0700 +++ hivex-1.2.5/lib/hivex.c 2011-07-07 09:10:06.927429068 -0700 @@ -321,6 +321,8 @@ if (full_read (h->fd, h->addr, h->size) < h->size) goto error; + close(h->fd); + h->fd = -1; } /* Check header. */ @@ -541,7 +543,10 @@ munmap (h->addr, h->size); else free (h->addr); - r = close (h->fd); + if (h->fd >= 0) + r = close (h->fd); + else + r = 0; free (h->filename); free (h);