The Off-Key Bard
Technology

Why Can I Safely Unplug Some USB Devices but Others Need to Be Ejected?

Or: what exactly is Windows doing when it says "Safe to Remove Hardware"? Computers cheat on storage writes — and Eject is how you make them stop cheating.

Or: What Exactly Is Windows Doing When It Says "Safe to Remove Hardware"?

You plug in a mouse, use it, unplug it. Nothing. Keyboard, controller, webcam, USB headset — pull the cable and move on with your life. Then you plug in a flash drive and suddenly Windows has opinions. There's an Eject option. There's a Safely Remove Hardware icon. We've been warned for years that yanking a flash drive without ejecting could corrupt files or destroy data.

But most of us have unplugged a flash drive without ejecting at some point. And usually nothing happened.

So why do storage devices sometimes need to be ejected when other USB devices don't? And if it usually works anyway, what does Safely Remove Hardware actually do?

The answer comes down to something computers do constantly without telling you: they don't always perform an operation exactly when you think they do.

USB Is Many Things

Part of the confusion is that USB describes a connection standard, not a type of device. The same connector can carry data for a keyboard, provide power to a charger, or transfer files from a flash drive. A mouse, a webcam, and an external SSD can all use USB while doing completely different jobs.

When you unplug a mouse, the computer loses access to the mouse. That's inconvenient if you were using it, but there's no complex collection of stored information that Windows was halfway through modifying. Storage is different.

A Flash Drive Contains a File System

When you connect a flash drive or external hard drive, the computer doesn't just see a pile of data — it sees a file system, the organizational structure that tracks filenames, folders, free space, timestamps, and which parts of the drive belong to which files. When you create, modify, move, or delete something, the computer may need to update both the file itself and the structures that describe where everything lives.

Writing a file isn't necessarily a single atomic action: send data, done. Several coordinated operations may need to complete, and interrupting them at exactly the wrong moment can leave the file system in an inconsistent state.

Computers Love to Wait — Write Caching

Here's where the real issue lives. Storage performance matters enormously to operating systems, and constantly waiting for each write to physically complete on a relatively slow storage device wastes time. So operating systems use write caching: instead of making your application wait until every piece of data has physically reached the storage device, the computer temporarily holds some of it in RAM and writes it later.

From the application's perspective, the operation appears finished sooner. The actual storage device may still have work to do.

Think of it like a restaurant waiter telling you "got it" when you place your order. The cheeseburger doesn't exist yet — the restaurant has accepted responsibility for making it. Write caching works similarly. Your application gives data to the OS; the OS says "I've got it" and may hold it in RAM before actually sending it to the drive. The application can continue working instead of waiting. Most of the time this makes everything faster.

The problem appears when you remove the drive before the kitchen finishes the cheeseburger.

What Eject Actually Does

When you tell the OS to eject a storage device, you're not just making the icon disappear. You're saying: "I'm about to physically disconnect this. Finish whatever you're doing with it and stop treating it as active storage."

The OS flushes pending writes, completes necessary file-system operations, releases open file handles, and prepares the device to be removed. Once Windows tells you "Safe to Remove Hardware," it has reached a state where the disconnection should no longer interrupt any pending work.

The message isn't "the USB port has been magically deactivated." It's closer to "I've finished everything I needed to do. You can pull it now."

So Why Doesn't Yanking It Usually Cause Problems?

Because modern operating systems aren't reckless about this. Since Windows 10's October 2018 update, the default policy for removable drives is "Quick Removal," which disables write caching on those devices. Without write caching, there's generally no pending data sitting in RAM waiting to reach the drive, which makes casual removal considerably less dangerous.

That's why you've probably disconnected flash drives without ejecting hundreds of times without disaster. With Quick Removal, if the drive is completely idle and nothing has it open, unplugging it is usually fine.

But "usually fine" and "nothing can go wrong" are different things. If the drive is actively being written to when you disconnect it — and the progress bar is the obvious tell here — you're physically interrupting an operation. No software setting makes data arrive at hardware after you've disconnected the hardware.

The Drive Has Its Own Cache Too

Caching doesn't only happen inside Windows. Storage devices themselves contain controllers with internal caches. The OS sends data to the drive; the drive's controller decides when to commit it to the underlying flash memory. Modern storage devices are computers in miniature, managing wear leveling, error correction, internal queues, and their own buffering.

So the chain from "save this file" to "data is physically on the storage medium" can involve several layers of technology. That's part of why even seemingly finished operations can have pending work.

Why File-System Corruption Can Be Worse Than Losing One File

If the file system itself gets corrupted — not just a single file, but the structures that track where everything is — the consequences can be broader. Think of a library where someone is updating both a book and the catalog entry for that book, then loses power halfway through. Maybe the book is incomplete. Maybe the catalog points to the wrong shelf. Maybe the catalog says the book exists somewhere the data doesn't.

Modern file systems include journaling and other mechanisms designed to reduce this kind of damage, but no storage system enjoys having communication disappear during a write. That's why a badly disconnected drive occasionally triggers a "this disk needs to be scanned" prompt — the computer noticed the file system doesn't add up and wants to check its own work.

Why Doesn't a Mouse Need Any of This?

Because a mouse isn't maintaining a writable file system that your computer is actively modifying. It's sending movement and click data. Pull the cable and those signals stop. The same applies to keyboards, webcams, controllers, headsets — disconnecting interrupts the service they're providing, but there's no pending user data waiting to be committed to persistent storage.

USB is just the connector. The type of device determines what safe disconnection actually requires.

When Windows Won't Let You Eject

Sometimes you try to eject a drive and Windows refuses: "This device is currently in use." But you're not copying anything. What gives?

Something still has a handle on a file. File Explorer may be looking at a folder on the drive. Antivirus software may be scanning it. Search indexing may be examining files. A background sync process may have something open. Windows refuses to eject because it can't confidently say that nobody is using the device anymore — which is actually the safety mechanism working correctly.

If closing obvious applications doesn't clear it, the simplest solution is a clean system shutdown. Once the OS has shut down properly, pending operations are complete and the drive can be disconnected safely. Slower than finding the offending process, but reliable.

The Bard's Take

The Safely Remove Hardware prompt isn't because USB devices are fragile creatures that need to be tucked in before disconnecting. It's because computers cheat.

They cache things. They buffer things. They rearrange operations. They tell your application "got it" while some of the actual work is still happening in the background. Most of the time this makes your computer faster — you don't want every program freezing while it waits for each storage write to physically complete.

But when you're about to remove the storage device entirely, that optimization matters. Ejecting tells the computer: no more shortcuts. Finish everything now. I'm taking this away. The OS flushes what needs flushing, finishes what needs finishing, and then tells you it's safe.

Your mouse doesn't need that because Windows isn't maintaining a file system full of your photos inside the mouse. Your keyboard doesn't need it because there's nothing cached and waiting to reach your keyboard.

But a flash drive? The computer may still be talking to it after you think the conversation is over.

With modern Quick Removal defaults, unplugging a flash drive often works just fine. The key word is often. When the drive contains the only copy of something you care about, clicking Eject is a cheap way to replace "it's probably finished" with "the computer says it's finished."

Sources

← Back to the Desk — Technology