disk3s3 is the extra partition on the time machine disk which OS X is complaining about. From what I have read (https://discussions.apple.com/message/19675983#19675983) this is a partition called "Boot OS X" which might have been installed on your time machine disk around the time of upgrading to 10.8.2. According to the linked article, this partition contains a copy of the Recovery Partition (http://support.apple.com/kb/ht4718) which you can boot from in the event that you cannot boot from your primary hard disk. This will only give you access to Recovery Mode, not a full OS installation.
I have observed that this partition is not mounted when you plug in the time machine disk (use the "mount" or "diskutil activity" commands to see this) but instead appears to be mounted when Time Machine finishes a backup. I don't know why it does this.
When you "eject" the disk from the Finder, you probably need to wait a few seconds before unplugging it. When the drive icon disappears, this probably means that the main time machine volume has been unmounted, but maybe it is still unmounting the recovery partition. This is likely the cause of your error message about having unplugged a disk without ejecting it. If you are paranoid, type "mount" to see all the mounted volumes, and verify that the time machine volume is no longer mounted before unplugging the disk.
lsof is indeed your best bet. The fastest and easiest way would be this :-
sudo lsof /Volumes/myDrive
It can take a couple minutes to run, but once it's complete, it gives you a list of open files on the disk. The output will look something like this:
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
mds 89 root 19r DIR 52,3 432 2 /Volumes/Photos
mds 89 root 23r DIR 52,3 432 2 /Volumes/Photos
Finder 681 alans 14r DIR 52,3 432 2 /Volumes/Photos
QuickLook 2158 alans 9r REG 52,3 1141591 78651 /Volumes/Photos/_tmp_iphone_10_backup/APC_1546.JPG
In this case, it's the QuickLook application that has a file open. Closing the application directly is the best way to fix the issue. However, that's not always possible. For example, QuickLook doesn't show up as an application you can get to in the Dock.
If you can't close the application manually, you can use the kill command to terminate it from the command line. To do that, use the PID from the second column as the ID to kill. From the above example, it would be:
kill 2158
Note that sometimes that doesn't work and a more aggressive form of kill must be used. Here's a series of escalating aggressiveness (using the example PID of 2158):
kill 2158
sudo kill 2158
sudo kill -INT 2158
sudo kill -KILL 2158
You should be able to eject the disk once the process/application has been killed.
One final note, lsof can take a minute or two. It can also hang, but you should give it at least a few minutes before you decide that's what happened.
Also, sometimes the base command sudo lsof /Volumes/myDrive won't find anything. If that happens, try adding the +D argument (i.e. sudo lsof +D /Volumes/myDrive). That will do a top down scan of the disk. It'll take longer, but it should pick up anything that's causing the disk to be un-ejectable.
(Hat tip to Alec Jacobson's post for extra details.)
Best Answer
If you cd- change directory to the mounted filesystem then you must cd out of the filesystem before you can eject it. As an example
cd: changes the current working directory to your home folder
diskutil: ejects the filesystem
There is one case where the tab needs to be closed. Sometimes the initial working directory is on the volume. (This can happen if you open a new tab from an existing tab that is visiting the volume.) When this happens, two processes are initially using the volume:
login, and the shell it launches.cdwill change the working directory in the shell, but won't affect theloginprocess. The only way to makeloginstop using the volume is to close the tab.If you're not sure which tab(s) to close, you can use
lsof:This command will show the process IDs (and other info) for all
loginprocesses that have open some subdirectory of the volume. With the process ID, you can either:ps(ps -o tty -p <login pid(s),>)loginby sending it/them a SIGHUP (kill -HUP <login pid(s)>)