KomuraSoft LLC
Contact
Menu

Is Safely Removing a USB Drive Still Necessary? — Thinking It Through from Quick Removal and Write Caching

· Updated: · · Windows, USB, Storage, Troubleshooting

Revision history (first version, published Sep 12, 2026)
First published

You copied your files to a USB drive. The screen said the copy was complete. And yet, before you unplug it, you are told to go through Safely Remove Hardware one more time.

It was supposed to be finished, so what is there left to finish?

The data an app handed to Windows may still be waiting on the PC to be written. Let us follow a single file on its way to the USB drive.1

This assumes USB storage connected to Windows 11. File transfer from a smartphone and similar cases are out of scope.

1. Before Anything Reaches the USB Drive, the PC Holds It

For this explanation, split the file into three pieces, A, B, and C. The app hands them to Windows in order and asks for them to be written to the USB drive.

If it had to wait for every write to the USB drive, the app would be kept waiting too. So Windows can reply as soon as it has taken the data into the PC’s memory and write it to the USB drive later. The point is to avoid keeping the app waiting and to handle small writes together. That temporary holding area is the write cache.12

Consider the moment when Windows has received A, B, and C but has only managed to write A and B to the USB drive. C is waiting its turn on the PC.

For the same file, what the PC has received and what the USB drive has recorded differShows the moment when Windows has received A, B, and C, has recorded A and B on the USB drive, and C is still waiting in the PC-side cache to be written.Windows has received A, B, and CPC memory holds C, waiting to be writtenRecorded on the USB drive, A and B only

Figure 1: The app handed over all three. Even so, at this moment C is not yet on the USB drive.

Unplug at this point and C, still on the PC, never reaches the USB drive. Part of the file you carried away is missing.

The app handed over everything. But the USB drive does not have everything yet. In a design that defers writes, both of these can be true at once.

When the completion message appears depends on the app and the settings. This example is not saying that writes always remain after File Explorer reports completion.2

2. Finish Writing What Was Held Before You Unplug

So how do you unplug the USB drive without leaving C behind?

Safely Remove Hardware is the action that tells Windows this device is coming out, so please finish the writes that remain. Completing the operations still sitting in the cache is one of its jobs.3

For the file above, that means writing out C, which was still on the PC, and waiting until the USB drive holds A, B, and C as well.

How the same pending write C turns out depending on how you remove the driveIf the connection is cut while C remains on the PC, the USB drive holds only A and B, but if C is written out while the drive is still connected, the USB drive holds A, B, and C.Unplug before writing CWrite C out while still connectedC is on the PC, waiting to be writtenUSB drive has only A and BUSB drive has A, B, and C

Figure 2: What you want to wait for with Safely Remove Hardware is not the passage of time but the completion of the remaining writes.

Just waiting a little before unplugging tells you nothing about whether anything is left. The removal action asks Windows to run the shutdown work, and you can confirm the notification that says the device is safe to remove.4

Windows’ Better performance is the policy that allows this cache to be used. In exchange for batching writes for efficiency, you have to run Safely Remove Hardware before you unplug.3

3. Quick Removal, the Policy That Does Not Defer

You may be thinking, if the remainder has to be written out before unplugging, why let anything remain on the PC in the first place?

That is exactly what Quick removal is. Windows does not cache disk writes to the device in question, which makes it possible to skip the removal step. In other words, it does not use the approach of leaving C on the PC and writing it later.3

The work of writing to the USB drive remains. There is less room to batch writes for efficiency, and performance can drop, but in exchange the drive becomes easier to remove.3

A policy that defers writes and a policy that does notWith Better performance the PC can hold pending writes but completion has to be confirmed at removal time, while with Quick removal Windows does not defer writes that way.Better performanceThe PC can hold writesWrite out the remainder before unpluggingQuick removalWrites are not deferredThe removal step after your work can be skipped

Figure 3: The work of writing to the USB drive does not disappear; what changes is whether it is deferred.

Since Windows 10 version 1809, the default is Quick removal. That is the basis for claims that you can now simply pull the drive out. The setting can be changed per device, however.3

In short, do you finish the deferred work before unplugging, or do you never defer it at all? The two claims that safe removal is required and that it is unnecessary both come from this difference in setting.

Even with Quick removal, that does not mean you may interrupt a copy or a save in progress. Wait for the operation to finish, and save any unsaved edits first.5

4. Which Setting Is Your Own USB Drive On?

In File Explorer, check the name and drive letter of the USB drive in question.

Right-click the Start button, open Disk Management, and right-click the label of the matching device in the lower list. Properties > Policies shows which of the two is selected.3

If Policies is not visible, there is also a layout where you select the drive on the Hardware tab and open Properties from there. If you are only checking, do not change the setting. If you cannot perform the steps on a company PC, ask your administrator.3

If you do not know the setting, using Safely Remove Hardware is the easier practice to follow. Finish your saves and copies, then close the apps that use the USB drive. Pick the device under Safely Remove Hardware and Eject Media in the notification area, and unplug it once the notification says the device is safe to remove. If the icon is hidden, open the list of hidden icons.4

When several devices are attached, match the name you selected against the USB drive you actually unplug.

5. Why Does It Say the Device Is In Use After the Copy Finished?

A, B, and C of the file have all been written to the USB drive. But if the app you used to check the contents still has the file open, the next action could read it again or rewrite it.

The removal process also checks whether that kind of use can be ended. When a handle, the reference an app uses to work with a file, is still open, removal can be refused even though reads and writes have stopped.67

An app in use is still attached to files that have already been writtenEven when A, B, and C are all recorded on the USB drive, an app that keeps a handle to the files can block removal of the device.Keeps a handleApp that still has the file openFiles on the USB drive, A, B, and CThe reference remains even when reads and writes stop

Figure 4: This is the case where the reason you cannot remove the device is not missing data but the fact that the device is still in use.

In this case, do not just wait; save what needs saving and close the app. Close any File Explorer window showing the USB drive as well, and retry the removal.

If nothing comes to mind, search Process Explorer for the file or folder name on the USB drive and find out which process has it open. Avoid force-closing a handle you find, since that can destabilize the app or the system. Close the app through its normal procedure, and for a business application or a service, check with the person responsible.87

This is one example of a cause. For detailed investigation methods, see How to use Process Explorer and Handle.

6. A Note for App Developers: What Save Complete Means

Be deliberate about whether your app reports Save complete merely once the data has been handed to Windows, or only after checking the result of the writes it needs.

The Win32 FlushFileBuffers API writes out the buffered data for the specified file. A call on an ordinary file handle does not save another app’s unsaved document, nor does it end use of the whole USB drive.2

Before and after the Windows cache there are also unsaved data inside the app and the cache inside the device. Quick removal is not a setting that eliminates all of those too.9

Each place that holds data has a different ownerShows unsaved data inside the app, the file cache on the Windows side, and the cache on the device side, in the order the data passes through them.Save operationWrite to the deviceIn the app, unsaved changesOn the Windows side, the file cacheOn the device side, internal cache and media

Figure 5: Whether data remains in each layer depends on the settings and the implementation. Do not mistake the setting of one layer for a completion check of another.

An app that handles removal notifications also needs cleanup such as closing its device handles.10 Choosing between the APIs is covered in the cache manager and WriteFile article.

Summary

What you can carry away on a USB drive is the data that has finished being written to it. If you do not know the setting, finish your work and use Safely Remove Hardware. For important files, keep a copy somewhere other than the USB drive.

In the diagram a solid line marks a relation that always holds and a dashed line marks a conditional one (the conditions are given per relation on the detail page). The full list of relations (6 in total, with evidence and certainty) and the definitions of the main concepts are collected on the knowledge map detail page (in Japanese). Data: JSON-LD / Turtle

  1. Microsoft Learn, File Caching. The in-memory file cache, lazy writing, and the role of flushing. ↩ ↩2

  2. Microsoft Learn, FlushFileBuffers function. Ordinary writes versus writing out buffered data. Flushing a file and removing a device are different things. ↩ ↩2 ↩3

  3. Microsoft Learn, Manage default media removal policy. The difference between Quick removal and Better performance, changing the default, and checking the per-device setting. ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7

  4. Microsoft Support, Safely remove hardware in Windows. The removal action from the notification area, and the notification that the device is safe to remove. ↩ ↩2

  5. Microsoft Learn, Handling an IRP_MN_SURPRISE_REMOVAL Request. The I/O failures and cleanup that follow an unexpected device disconnect. ↩

  6. Microsoft Learn, Handling an IRP_MN_QUERY_REMOVE_DEVICE Request. The check before removal, open handles, and how the file system and applications respond. ↩

  7. Microsoft Learn, Handle. Investigating open file references, and the warning about force-closing handles. ↩ ↩2

  8. Microsoft Learn, Process Explorer. Searching for the process that has a particular file or directory open. ↩

  9. Microsoft Learn, File Buffering. The distinction between the file buffers on the Windows side and the cache on the hardware side. ↩

  10. Microsoft Learn, DBT_DEVICEQUERYREMOVE event. How an app prepares for removal and closes its device handles. ↩

Related Articles

Recent articles sharing the same tags. Deepen your understanding with closely related topics.

Related Topics

These topic pages place the article in a broader service and decision context.

Where This Topic Connects

This article connects naturally to the following service pages.

Frequently Asked Questions

Common questions about the topic of this article.

Is safely removing a USB drive still necessary on Windows 11?
It depends on the removal policy of the device in question. Quick removal is designed so that the step can be skipped, but with Better performance you need to run Safely Remove Hardware. If you do not know the setting, the easier practice is to finish your saves and copies, close the apps that are using the drive, and then run the removal action.
With Quick removal, is it fine to unplug the drive during a copy?
No. Quick removal is a policy that keeps Windows from caching disk writes and deferring them. It is not a feature that completes data you have not sent yet, and it does not mean you may interrupt a copy or a save in progress.
Where do I check whether a drive is set to Quick removal?
Check the drive letter and name of the USB drive in File Explorer, open the properties of the matching device in Disk Management, and look at Policies. If the tab is not visible, select the device on the Hardware tab and open its properties from there. The layout differs between environments, and you do not need to change the setting just to check it.
Why does Windows say the device is in use when the writes have finished?
If an app still has a file or folder open, the device is not necessarily finished being used, even when traffic has temporarily stopped. First save and close the files involved, confirm that copies and backups have ended, and then retry the removal. If necessary, use Process Explorer to find the process that has them open, but avoid force-closing handles.
If I use Safely Remove Hardware, will a document I forgot to save be written to the USB drive?
It will not. Safely Remove Hardware is not a substitute for an app's Save command. Save the document first and confirm that the app has indicated the operation finished. Do not keep important data only on a USB drive; keep a copy somewhere else as well.

Author Profile

Profile page for the article author.

Go Komura

Representative of KomuraSoft LLC

Focused on Windows software development, technical consulting, and investigations into failures that are difficult to reproduce.

Contact
Back to the Blog