Actual danger posed by surprise removal of NTFS volumes?

Question

I've seen a lot of warnings to always use the "Safely remove hardware" icon in the notification area (a.k.a. "system tray") before disconnecting a drive formatted as NTFS, implying dire consequences for failure to do so. (These consequence are generally attributed to write caching.)

Rarely, however, do I see anything about what those consequences might be. Furthermore, since NTFS is a journaling filesystem, actual filesystem corruption should not be one of them.

So I imagine the main thing that can go wrong is that something you believe you have saved will not have made it out to the disk yet when you yank the drive; in the worst case, this could result in corruption of files, but not of the filesystem, right?

So, my questions are

1. Is there some other type of problem I haven't thought of?
2. How long might Windows hold off on writes; i.e., how far "back in time" might the filesystem go due to surprise removal? (Presumably there are also space limits?)
3. I don't need to do anything special to get Windows to play back the journal, do I? (If so, what?)

(I ask because, thanks to my ADD, it's not a matter of if I will forget, but rather of when I will do so.)

Answer 1

When you yank out the cord, the results are unpredictable. And double so if the USB cable is also supplying the power.

It is normally safe to yank it after a certain period of inactivity on the device.

But if you yank it during disk activity, nobody can predict (1) what the damage will be, (2) whether the damage will be fixed when you re-plug it in, and (3) whether the damage will ever be noticed before it is too late (meaning when this disk contains your only copy of the file you just destroyed).

To minimize such problems, it is a good idea to check that a removable drive is optimized for quick removal, by in Explorer right-clicking on it, Properties, Hardware tab, select drive and press Properties, Policies tab, select "Optimize for quick removal", OK.

As regarding your question of what Windows does exactly with writes, the answer is fairly easy : Nobody knows. And what has been learned can change without warning.

Answer 2

To answer the first part, remember that when you yank a drive you also remove the power and so for a fraction of a second the electronics are going to go unstable on you and you cannot predict what type of effect this will have on any writes currently in progress so journals and data files etc. could well be corrupted.

With regards to write caching, the amount of time that elapses before 'dirty' data (changed data sitting in cache somewhere) is flushed to the disk will depend on many factors including the OS, controller, disk hardware and whether the feature has been disabled.

NTFS journalling will kick in to help try and recover an 'unclean' disk during the system boot phase - there's some useful info here: http://technet.microsoft.com/en-us/library/cc781134%28WS.10%29.aspx