USB safely removed? Why you probably don't need to worry anymore
If a USB flash drive or an external hard drive is in use when we want to disconnect it from the computer, Windows will notify us by pressing the safe removal button. However, it does not indicate which program currently uses the drive. Fortunately, it's possible to check this.
The "safe removal of devices" function is often joked about. USB flash drives are rarely damaged during disconnection, and the warning message sounds disproportionately ominous compared to the actual consequences. The system frequently warns against disconnecting the USB even when nothing uses the drive. Safe removal in Windows has become so unnecessary that many people are unaware of this function and simply unplug the USB flash drive after use.
Windows has also been optimized for file queuing and cache handling to minimize losses in case of sudden disconnection. Combined with the increase in the speed of solid-state drives, the need to perform a special operation before detaching the media has practically disappeared. The last systems that unconditionally warned the user after unplugging the flash drive without warning were Windows Millennium Edition and Windows 2000. Even XP stopped doing this after one of the Service Packs.
Is it necessary?
Today, we will only get an error message if we interrupt an in-progress operation by unplugging or if a program tries to read from a drive that has just been removed. Nevertheless, safely removing the device can be useful in the case of older devices, platter-based drives, or media or data, which we particularly care about avoiding loss/damage.
Today, the safe removal icon uses less pretentious terminology and describes the options for USB flash drives and drives as "ejecting the media." If the ejection is successful, it means that no I/O operations were ongoing, the write cache was synchronized, and no program was waiting for the presence of the media, which we can then unplug.
A native notification in the screen's bottom right corner will announce the ejection procedure's success. However, the ejection mechanism will be denied if a program still uses the drive. Windows will then display an archaic window with the form and content from Windows 2000. However, it does not contain information about which program vetoed the media ejection.
Let's use PowerShell
This information is available in the system log and can be extracted using Event Viewer and PowerShell. In client versions of Windows, reading this information does not require administrative privileges. To find out which process vetoed the last attempt to eject the media (and which media it was), you should use the following command:
This way, we will get the program's name and PID, as well as the exact name of the blocked device. With this information, we can locate and disable the problematic program and then try again. Very often, in Windows 11, the program vetoing the ejection request is the Task Manager. Therefore, closing it before resorting to the terminal and PowerShell commands is worth closing.
