Rethinking safe USB removal in modern Windows: Is it still needed?

If a USB flash drive or an external hard drive is in use when you want to disconnect it from your computer, Windows will notify you when you press the safe removal button. However, it won't indicate which program currently uses the drive, but you can check this.

The "safe removal of devices" function has long been a subject of jokes. USB flash drives very rarely get damaged during disconnection, and the warning messages sound disproportionately ominous compared to the actual risk. Often, the system warns against disconnecting the USB even when nothing is using the drive. Safe removal in Windows has become so unnecessary that many people are unaware of this function and simply unplug the USB flash drive after use.

Windows has also been optimized for file queuing and cache handling to minimize losses in case of sudden disconnection. Combined with the increased speed of solid-state drives, the need to perform a special operation before detaching the media has practically disappeared. The last systems that unconditionally warned the user after unplugging the flash drive without warning were Windows Millennium Edition and Windows 2000. Even XP stopped doing this after one of the Service Packs.

Today, you'll only get an error message if you interrupt an operation by unplugging or if a program tries to read from a drive that has just been disconnected. Nevertheless, safely removing the device can be useful for older devices, platter-based drives, or media or data you particularly care about.

Today, the safe removal icon uses less pretentious terminology and describes the options for USB flash drives and external drives as "ejecting the media." If the ejection is successful, it means that no I/O operations were ongoing, the write cache was synchronized, and no program was waiting for the media, allowing you to safely unplug it.

The success of the ejection procedure is announced by a native notification in the bottom right corner of the screen. However, if a program is still using the drive, the ejection will be denied. Windows will then display an archaic window with a form and content similar to those from Windows 2000. Unfortunately, this window doesn't provide information about which program prevents the media ejection.

However, this information is available in the system log and can be accessed using Event Viewer and PowerShell. In client versions of Windows, reading this information doesn't require administrative privileges. To find out which process vetoed the last attempt to eject the media (and which media it was), you should use the following command:

Using this command, you'll get the name of the program and its PID as well as the exact name of the blocked device. With this information, you can locate and disable the problematic program, then try again. Very often in Windows 11, the program vetoing the ejection request is Task Manager. Therefore, it is worth trying to close it before resorting to the terminal and PowerShell commands.