Security photo
SHARE

Pull a USB flash drive out of your Mac without first clicking to eject it, and you’ll get a stern, shameful warning: “Disk Not Ejected Properly.”

But do you really need to eject a thumb drive the right way?

Probably not. Just wait for it to finish copying your data, give it a few seconds, then yank. To be on the cautious side, be more conservative with external hard drives, especially the old ones that actually spin.

That’s not the official procedure, nor the most conservative approach. And in a worst-case scenario, you risk corrupting a file or—even more unlikely—the entire storage device.

“I’ve been pulling out thumb drives since the last five years and I haven’t had a problem,” says Frank Wang, a PhD candidate in computer science at MIT. Granted, that’s anecdotal evidence, but he estimates that the vast majority of the time, “for the average user, nothing bad would happen.”

It’s worth taking a look at what’s happening behind the scenes when you remove a thumb drive, and why it’s unlikely to mess up much, if anything.

What could go wrong?

First, some context, and the bad possibilities.

Say you’re copying a file from your computer to a USB drive. Your machine may actually be using something called a write cache; instead of transfering the file from one device to the other directly, it’s using that cache to make the process more efficient. The cache is just local memory storage that your computer is really good at writing to, quickly.

“When you write to the drive, it will actually just write it into memory, and then come back to you and say, ‘yeah I wrote it,’” says Andy Pavlo, an assistant professor of computer science at Carnegie Mellon University. “But it’s actually not made it to the drive yet.”

With a write cache, your computer will finish the copying process in the background. All of it happens very quickly, from a human perspective: “We’re talking like milliseconds here,” Pavlo says. A Mac’s operating system always uses the write cache, but on a Windows machine, the user can decide whether to enable it or not; the default is that the write cache is off.

Managing data in the write cache is where the “eject” feature comes in. “The eject basically says, ‘okay, we’re pulling this thing out, flush the write cache,’” Pavlo says.

Knowing about the write cache is key because there is a theoretical risk that while you think the computer has finished transferring your files, it actually hasn’t. For that reason, Pavlo recommends properly ejecting if you’re using a Mac, because it always uses the write cache feature.

So what bad stuff could happen if you pull the thumb drive out while you’re copying a file to it, or while the write cache is doing something in the background?

The first possibility is that the file you were copying to the USB drive gets corrupted (although chances are the original file on your computer would still be okay). After that, there’s the chance that another file on that thumb drive gets corrupted, too.

The biggest problem would be if you were to corrupt the USB drive itself—the file system metadata could be ruined, meaning the drive wouldn’t know where things are stored.

For the record, SanDisk, which makes external storage devices like USB drives, says to follow official protocol. “Whether it’s a USB drive, external drive or SD card, we always recommend safely ejecting the device before pulling it out of your computer, camera, or phone,” Brian Pridgeon, director of product marketing for SanDisk, said in a statement. “Failure to safely eject the drive may potentially damage the data due to processes happening in the system background that are unseen to the user.”

But let’s be optimistic

So should you bother to hit eject? “Generally, it’s not going to make much of a difference,” says Jim Waldo, the chief technology officer at Harvard’s John A. Paulson School of Engineering and Applied Sciences.

“The catastrophic form of failure,” he says, “would be that if you picked just exactly the right time when it was in the middle of a write, so it had written some bits and not others, you could corrupt your USB drive—but your chance of doing that is so slight, that I have never had it happen, [and] never heard of it happening.”

In other words: corrupting that drive is very, very unlikely.

If you’re concerned you might interrupt something the write cache is doing in the background after you’ve copied a file, rest assured that the process finishes so quickly that humans who move at regular speed shouldn’t worry about that, says Waldo, “unless you’re the Flash.”

Frank Wang, the MIT PhD student, agrees that fast write speeds to modern USB drives are key. “By the time it looks like it’s done, and you’re able to perform the action of pulling it out, it would have already finished,” he says.

In short, follow these rules of thumb if you want to live dangerously and just yank that USB drive out: Don’t do it while it is actively copying, and don’t do it within milliseconds after it has finished. Be aware that a Mac will be using a write cache, while a Windows machine probably is not. The more modern the equipment, the better your chances that nothing bad will happen.

Finally, it’s best to play it safe when dealing with something like an external hard drive (although it may be hard to corrupt a modern, solid-state external drive). If you’re using one to make backups of your computer, for example, like with Time Machine on a Mac, it’s best to hit eject. That rule applies even more so to an old, spinning drive. It takes much longer to write information to a spinning drive than it does something with solid-state storage, and since it has moving parts, it is more susceptible to damage.

“In terms of threats to worry about on a USB drive, unplugging it without ejecting the drive is way down there,” Waldo says. A bigger threat? Plugging one in. That’s because, he points out, there’s always the chance it has a virus on it.

Load more...