62

There is a lot of information about how to safely unplug USB hard drives. However, the articles tend to stop at the part where the operating system says it is safe to unplug, or where you're sure nothing is writing to the drive, etc.

Relevant set up:

  • Windows 10 PC or Windows 10 notebook
  • External USB hard drive (not a USB stick)
  • Click "Eject External USB 3.0"
  • Wait for "Safe To Remove Hardware" notice

After the operating system declares that it is safe to unplug a USB hard drive, the LED on the drive blinks about 10 times before the drive shuts down.

I've used a number of external 1TB to 4TB HDDs by Toshiba and Seagate, and they all consistently blink their LEDs about 10 times when ejected. The blinking happens after the OS says it is "Safe to Remove Hardware". Although the OS is limited to seeing the completed buffer-flush whereas the drive's firmware can detect when the writes have completed, the 10 blinks happen even when the drive is just plugged in and immediately ejected with no writes at all. Likewise, it's still the same 10 blinks when the drive is written to extensively, then ejected.

Some theories:

  • The 10 blinks are just a courtesy to make it easier to identify which drive was ejected when multiple drives are plugged into a single computer.

  • There is a fixed latency between the OS flushing its write buffers and the writes getting physically encoded. This would explain why any non-zero amount of writes produces a fixed delay on eject. However, the 10 blinks still take place if there was a long delay between writing and ejecting, or if there wasn't any (intentional) writing at all.

  • The 10 blinks represent a safety margin for the drive to park its heads. That sounds like a rather long time just to park heads, though, with each blink lasting about a second.

So, is it safe to unplug the hard drive while its LED is still blinking?

I've tried finding an authoritative answer, even checking on Seagate's and Toshiba's websites, looking at the datasheet in the case of Toshiba. I'm looking for answers that reference credible sources regarding what the drive does during the shutdown blinking sequence, to understand whether unplugging during that sequence is safe.


Here are some other areas I checked:

  • 2
    If its blinking the OS is either reading or writing the usb, not safe to unplug. – Moab Sep 15 at 13:32
  • 1
    In the way you're asking (i.e. Windows says safe to remove, drive shows activity for a few seconds afterwards), wait until the OS and kernel have completely ceased all I/O activity. There's likely a way to see a log of such activity (in Linux, it would be the kernel log), however I'm not sure how to in Windows. There could be a myriad of reasons for this extra communication, but needless to say, wait until all I/O activity has stopped, else you risk data loss or corruption (which may not be immediately noticeable) – JW0914 Sep 15 at 14:42
  • 1
    I have found on occasion that my external hard drive is still spinning when I unplug it and go to pick it up. I wonder if those 10 seconds are after the writes are done and the heads are parked, but before the platters are done spinning. (If that were the case, I assume unplugging would be safe, but picking it up and moving it might not? I'm not sure.) – Glenn Willen Sep 16 at 13:49
  • 6
    LEDs are not a required standardized feature of USB storage, therefore their existence and behavior should only affect how you treat the device if the device manufacturer explicitly tells you to. – kayleeFrye_onDeck Sep 16 at 20:12
  • 2
    Have you tried asking Seagate or Toshiba (we can't do that for you; we don't know what model number you are using)? – Brian Sep 16 at 20:54
38

Usually it is, do what the user manual says

If the drive's firmware is written correctly, it announces to Windows that it's ready to be ejected when it is. It is therefore safe to do so.

If the drive's firmware is written incorrectly, it may announce that it's ready to be ejected while still busy with important stuff. It's therefore not safe to eject it, but then, it is never truly safe to eject (or do anything else) with a drive which has a buggy firmware.

For instance, here is a random HDD manual which says:

  1. Click the “Hardware and Eject Media – icon” A pop-up message box will appear listing the external devices connected to your computer.
  2. Select the TOSHIBA drive to eject. After a few seconds, you will get the notification that it is now safe to remove the device.
  3. Click “OK” and you can unplug the drive now.

Note there's no mention of LED activity. Indeed you should check the manual of your drive, and if it says "wait for the LED to blink out EJECT in Morse code", you should absolutely do that. I'm yet to see such a manual though.

If you absolutely need your data to be there, verify the integrity of the data you have written, and make backups. Otherwise, when your data on a portable HDD is gone, the fact that you have waited until the LED blinks ten times will be of little consolation.

  • 2
    This makes a lot of sense. I wasn’t aware that the OS got an eject-ready signal from the drive. – Lawrence Sep 16 at 15:11
  • 11
    @Lawrence: The signal isn't specifically "ready to eject", it will be more along the lines of "all pending operations (up through command #X) are fully committed". And the OS, because it knows it is going to eject the drive, doesn't send any new commands after the flush/sync. – Ben Voigt Sep 16 at 18:16
  • 1
    @Lawrence: Well, most operations do not use the flush/sync command. But perhaps the OS is also sending a "park heads" or similar (which a flash drive would interpret as prepare for power down even though it has no heads to park) – Ben Voigt Sep 17 at 13:29
  • 1
    @Lawrence OS Head parking without spinning down is done by laptop drives to make the drive more resilient to shock, and is counted by the SMART 'Load_Cycle_Count' counter. Heads are automatically parked when after spin-down. There is not a reliable method of parking a head manually, (hdparm says otherwise, but trust me, not all drives behave the same) – Bora Sep 17 at 13:43
  • 2
    Drives no longer blink on a "per operation" basis, many drives just have an "LED on" and "LED off" state, and when "on" it blinks. Try writing a 1 byte file to an SSD or thumb drive (or in Linux, touch a file) -- you will likely observe that it blinks rapidly for a solid second or two for that one tiny write. I think it's more of a UI thing, with the blinking persisting long enough to be perceived by the user... thus these last 10 (or however many) blinks are that persistence after the final write. – Doktor J Sep 17 at 14:09
16

I haven't seen any official source that describes the reason for blinking disk indicator after Safely remove, so what I write here is only based on general knowledge and observation. This happens for some disks because of the way that the firmware interacts with the operating system.

Windows announces that the device is safe to remove once it has flushed all its data from the memory cache and signaled the device's firmware to spin down.

The firmware itself may take some time to process the spin down command. Many USB hard drives also incorporate cache memory that will be lost if the disk is brutally powered down. The firmware will need its own time to terminate all writes and to spin down the disk. While it is doing that, the disk's indicator will blink.

It is certainly not safe to unplug the disk and power it down while the lights are blinking, since they indicate that the firmware is actively doing something. Some disks can recover from an abrupt power down by using non-volatile cache memory, so they can pick up when the disk is powered up from where they stopped.

Beginning from Windows 10 version 1809, it is safe to unplug the disk whenever the disk is not blinking. Safely remove is no longer strictly necessary, although I would still recommend it.

  • 10
    Can you provide any sources for your last sentence (about safely remove not being necessary anymore since Windows 10 version 1809)? – gronostaj Sep 16 at 8:27
  • 10
  • 10
    And I'm pretty sure Windows doesn't just signal the drive to spin down and calls it a day. IMO it sends the SCSI sync-cache command first, which only returns once the HDD has flushed its own cache to the platters. – Dmitry Grigoryev Sep 16 at 8:55
  • 5
    Thinking about your penultimate paragraph, that also means that Windows now defaulting to "Quick removal" is lulling users into a false sense of security :( – Lightness Races in Orbit Sep 16 at 10:41
  • 16
    @DmitryGrigoryev: It returns when the drive claims it has flushed its own cache to the platters. You can read the SQLite source code or some NSFW comments in the Linux kernel source code about drives that are, shall we say, "less than honest" in the interest of improving benchmark figures. – Jörg W Mittag Sep 16 at 13:51
1

Data is only guaranteed safe when electrical activity of external drive has stopped. Blinking shows that the external drive is still receiving electric power from the computer, therefore we cannot be sure that some data operation will not happen.

In Linux this is easy to make sure, because unmount and detach are two separate stages:

udisks --unmount /dev/sdb1 ..LED on, power ON

udisks --detach /dev/sdb ..LED off, power OFF

Windows does not have Power Off command but only Eject, which is similar to unmount, therefore in Windows in some cases it might be better to shutdown the whole computer as that guarantees that the external drive is also free of electric power.

  • When you use the detach option, does it cause your external USB HDD to do a 10-blink sequence? – Lawrence Sep 17 at 22:43
  • Shutting down Windows to remove an external HDD seems like a massive overkill. And according to Arch wiki, --detach is needed to prevent the disk from being re-mounted on systems that re-mount disks automatically. If you really have problems with unmounted drives reporting errors after being unplugged, try udisks --inhibit-all-polling – Dmitry Grigoryev Sep 18 at 7:56
1

No, it is not (completely) safe !!!

It should be (and in almost all cases it will be), but you cannot be absolutely sure in any sense.
Sadly life is not (always) what it should be.

In my personal experience only a few times in several years (and specifically not with windows 10) I remember a data loss or file system corruption if removed quickly immediately after the go-ahead of the system. But it only happened with a second person ready to remove the USB and run away (immediately) after the go-ahead of the system and when writing operations were required at the very last moment.

The blinking indicates some activities in the device, or at least an hardware (not OS related) communication to the user. The blinking of some Seagate models is an error code [avid] communication. You may check if, with your model, that way of blinking (short or long pulses) has a special meaning. Usually 8 short pulses mean the byte zero, and 0 is the exit code of the program with no error at all...


TLDR

Premise. In general the scope of the question is so wide that there cannot be other single universally valid answers: too many models and brands may be involved. You must refer to both the manual of your HDD and the instructions of the operating system and drivers, consider the most restrictive and yet you will not be able to be absolutely safe.

Understanding what happens. The OS was reading/writing on the USB drive (HDD,SSD). You ask to remove this drive from the system. The OS stops/refuses the new I/O operation requests from its programs, waits the ending of the current I/O operations and checks if some lock is active on the device. When the device communicates that all the I/O operations are ended the OS will release the device declaring that you can safely remove the device.

In the ideal world it should be enough.

The problem is... The OS can answer only on the base of what the device itself answered. Usually both the device firmware and the OS drivers are closed source, so you have to rely on their documentation and on the License Agreements. The problem is that both sides are often valued considering their performances. They may rely on the fact that between the go-ahead of the system and the average human reaction time needed to unplug the device there usually is enough time for the modern devices to finish the internal operations in progress.

Moreover, the responsibility of each side is limited by the License terms. Limitations written to safeguard the company as much as it is possible, even if they knew or should have known about the possibility of the damages (see below for Windows 10, but you can find similar for the devices producers).
So, since they discharge the consequences in advance and are valuated on their performances, it is up to you to decide to what extent you can trust them and you will feel safe.

When you have at least one side that is open source you can read what happens

From a comment of another answer.
It returns when the drive claims it has flushed its own cache to the platters. You can read the SQLite source code or some NSFW comments in the Linux kernel source code about drives that are, shall we say, "less than honest" in the interest of improving benchmark figures. –

Safe and its meanings.

Now we can even specify in which sense you want to be safe...

  • Data transfer safe. As I really rarely experienced, you may believe to have saved your data on the external drive, but it was not all saved, or the FAT (or equivalent) was not updated... and next time you check you will find some sector to fix or that some files are not present. Write disk cache enabled may had played its role in the past.

  • Hardware safe. On some external HDD drive you can feel (and I did) that for some seconds after the system said you can remove, they still spin (you can even hear the vibrations). Unplugging the cable you interrupt the energy supply. If the plates are not spinning at their maximum speed it can rarely occur that there is not enough energy to park the heads safely onto the parking ramp [2].

  • Privacy safe. Ok let's suppose that the firmware is moving some data from a location to another (Some SSD do this in background to rotate the sectors used, some HDD firmware may do the same on sector that presented a reading problem on a sector). Before it copies the data in the new sector, then updates the FAT (or equivalent), finally frees the old sector or if required deletes the data from it. If the process is interrupted before the end, you can finish with a sector in which that data is copied, but it is not reported and managed correctly. If that was sensible data you are exposed to a security risk.

  • Legally/economically safe. You are protected for the data loss up to what fixed in the License terms, after that you will be able to proof the guilt and the culprit...


Conclusion: Wait some second more. :-)


From Win10 License Term [9.d][3]

The damage exclusions and remedy limitations in this agreement apply even if repair, replacement, or a refund does not fully compensate you for any losses, if Microsoft, or the device manufacturer or installer, knew or should have known about the possibility of the damages, or if the remedy fails of its essential purpose.

moreover

If your local law allows you to recover damages from Microsoft, or the device manufacturer or installer, even though this agreement does not, you cannot recover more than you paid for the software (or up to $50 USD if you acquired the software for no charge).

  • =1 for thinking of working it out via the terms & conditions. That’s out-of-the-box thinking. – Lawrence Sep 19 at 8:56
0

To your precise question, no, it is not safe until the blinking stops. Normally I do not see any blinking, but sometimes (not often) I do and wait. That works.

  • 1
    I've used a number of external 1TB to 4TB HDDs by Toshiba and Seagate, and they all consistently blink their LEDs about 10 times when ejected. The blinking comes after the OS says it is "Safe to Remove Hardware". Although the OS is limited to seeing the completed buffer-flush whereas the drive's firmware can detect when the writes have completed, the 10 blinks happen even when the drive is just plugged in and immediately ejected with no writes at all. Likewise, it's still the same 10 blinks when the drive is written to extensively, then ejected. – Lawrence Sep 15 at 15:57
  • 2
    Thank you for your answer. I've added to my question in an effort to clarify what I observed. Do you have any sources that say what the drive does during the shutdown-blinking sequence? (I understand that although that sequence always occurs on my external USB HDDs, it may not be standard behaviour across all drives.) – Lawrence Sep 15 at 16:25
  • 1
    I have seen various articles, nothing completely conclusive. Here is one such article: answers.microsoft.com/en-us/windows/forum/windows_10-files/… – John Sep 15 at 16:47
  • 1
    Thanks. I think there were a few characters missing in that link. Is this the one you were referring to? It talks about problems with ejecting USB hard drives. In my case, ejecting the hard drive succeeds. It's just the trailing blinks following successful ejection that I'm wondering about. – Lawrence Sep 15 at 16:52
  • 6
    Do you have a reference to back up the assertion in this answer? – J... Sep 16 at 21:52
0

I would consider it "not safe" for the simple reason that you have absolutely no idea what is going on inside a drive nowadays (nor does Windows).

Windows may send a flush command and get a "Yeah OK" reply, and you pull the plug, only to discover the next time you plug in the disk that nothing was OK.

So... the drive blinks for 10 second before powering down, fine. It will take 10 seconds extra, really... what do those 10 seconds cost you? What are these seconds compared to losing data? Nothing! Just give it those 10 seconds.

Modern drives (virtually all external Seagate drives, in particular) do weird stuff such as shingled magnetic recording which increases density by overlapping tracks, and causing massive write amplification in some non-obvious conditions. You write one byte, and the harddisk may have to reorder a megabyte or two (maybe?). The controller may find a checksum error and relocate the sector, which may cause another few megabytes to be rewritten, whatever.
The same is true for virtually all solid state disks. You write one byte, the controller may have to erase a complete 512k block, copy 53687091 bytes from the old block, and write your single byte. Or... something. The controller may discover that the block has reached its end of life (becoming non-eraseable) and may mark it as such, then erase a different block, and possibly it will have to do the same thing 3-4 times. Some drives have two or three layers of caching, some of which are volatile and some that are not, and some really weird, obscure wear-levelling algorithms that do some very non-obvious stuff, too.
You have absolutely no way of knowing. It could take 0.5 milliseconds or five seconds (unlikely, but still) to finish safely. It might correctly report "flush OK" or it might do it incorrectly. Like, who cares about correctness. I've had USB devices (not just disks) from "reputable" manufactorers which were so awfully standard-violating broken implementations... it's horrible.
Even Windows might be configured in a way that causes "surprises". For example, it is normally considered "safe" to unplug drives at all times as long as no writes happen. Except that isn't true at all when you or someone else using the computer e.g. turned on performance mode (which enables write cache and thus definitively moves disconnecting at haphazard times deep into the realm of "not safe").

Even more weird stuff (MAMR, and whatnot) is on its way to becoming mainstream, and we cannot know how whatever will be in a disk that you buy in 6 months from now will work (could takes 10 seconds during which it shoots microwaves at the platter to "finalize" the disk, whatever?), nor could the guys who once upon a time wrote the "eject safely" code possibly know.

The only thing that is really 100% safe is when there are no blinking lights and no sounds coming from the drive any more (sound is admittedly not such an awesome indicator on SSDs, but on a hard disk it's a pretty good one).

  • Sorry but I have to disagree. Sure you can wait for 10 seconds, but if waiting for Safe Eject confirmation may not be enough, waiting for the LED to stop blinking may not be just as well. Why not wait until the drive goes to sleep then? That would obviously be even safer, since heads are already parked, or what ever modern drives do. Is that what you meant by "no sounds coming from the drive any more"? – Dmitry Grigoryev Sep 26 at 8:17
  • @DmitryGrigoryev: That's what "no sounds coming from the drive any more" suggests, for a traditional drive. Unluckily, in the days of SSDs hearing the sound of electron traps being filled with electrons may be challenging. The LED is your only indicator, really, and so your best bet.. – Damon Sep 26 at 10:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.