0

I expect this has to do with caching, but the amount of time and data, and the lack of error messages, has surprised me. This is not an SSD.

A Windows-10 system that I have seen myself (through TeamViewer) has a removable hard drive and some 300 GB of data in it. It seems to be NTFS formatted (I forgot to check, but at least Windows 10 shows that all files are compressed). The device can be "safely removed"; however, if one removes the HDD "unsafely", data on the drive can still be accessed. This is not surprising in itself, as I would expected the Windows explorer to do some kind of caching of at least the folder structure. BUT:

  • Folder and subfolders can be browsed for minutes after the removal (basically until Windows notices the drive is gone).
  • Subfolders with photos are shown with the correct thumbnails (well, Thumbs.db, right), ...
  • ... but Photos can also be opened in a non-Windows photo viewer.
  • Folders can be renamed, and the operation seems to succeed.
  • And finally, I was able to copy a 200MB+ executable from the root directory to the Desktop, and verify that it is in fact an executable (Embedded icon, MZ, "Cannot be run in DOS mode", stuff like that - I did not dare run someone's SFX executable).

Is this generally expected? I know read-caching exists, but are the numbers expected (several minutes, several 100 MB, several dozen subfolders, ...)? Could this be the result of unwanted software or some system setting?

The reason I am investigating this is because the same system is reported to "forget" file system changes after rebooting (such as renaming a folder, rebooting, and finding the folder having the old name); or behaving weirdly after renaming objects (such as renaming a folder and soon after copying it, which is reported to have failed). Both issues are congruent with write-cache malfunctions, but we were unable to reproduce them.

I will have access to said computer in the coming days, so answers do not have to remain hypothetical.

Improve this question

1 Answer 1

Reset to default
1
  1. Windows caches the file structure to greatly speed access, particularly on a disk that has removal policy set to Better performance.

Drive removal policy

  1. In the dialog above, it states explicitly that the *Quick removal [policy]... [d]isables write caching. This reduces the risk of losing data, but dos not completely eliminate the risk if a user were to hold the power button down to force shutdown or if the drive were to be unplugged while writing. Most likely, the user failed to Safely Remove hardware and Eject Media before removing the drive.

Safely remove drive

Improve this answer
2
  • Thanks! 1. Your answer speak a lot about write caches, though, and while this relates to the reason of my investigation, my question itself was rather about (numbers related to the) read cache, and whether these orders of magnitude make sense.
    – bers
    Jun 2, 2017 at 7:36
  • 2. It is possible, though very unlikely, that the user unsafely removed the HDD when the originally reported issues arised, because the users is very well aware theses issues exist. Unsafely removing the drive was said to be an experiment carried out once (and repeated with me watching), which was said not to simulate any routine operation.
    – bers
    Jun 2, 2017 at 7:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .