Can you unplug a USB drive without ejecting it?

The copy window has disappeared, so can you pull the USB drive immediately? Sometimes Windows has already made that operation low-risk. Sometimes data is still buffered, a background process is using the volume, or the host follows a completely different rule.

The useful answer is not “always” or “never.” It depends on the operating-system policy, whether any I/O is active, and how the device handles power loss.

What Windows Quick removal actually changes

Windows offers two removal policies for external media [1]:

Microsoft made Quick removal the default policy for new external devices beginning with Windows 10 version 1809 [1]. The trade-off is straightforward: less write caching can reduce performance.

This is not a promise that every USB device can be pulled at any moment. Quick removal addresses Windows disk-write caching. It does not make an interrupted file transfer complete, and it does not define what a camera, phone, recorder, Linux system or device firmware is doing.

Why “the progress bar finished” is not enough

A host may still be updating filesystem metadata, thumbnails, an index, an antivirus scan or a backup after the visible copy ends. With write caching enabled, the application can also report completion before every buffered operation reaches the device.

Removing power at the wrong time can affect more than the last file. SanDisk lists filesystem damage, corruption, data loss, read-only state and drive failure among the possible consequences of unsafe removal [4]. The exact result depends on which data or metadata was in flight.

If valuable data has already become unreadable, stop writing new data to the medium. Follow a recovery-first workflow rather than formatting it immediately; our memory-card failure and recovery guide explains the safe order.

Check the policy instead of assuming

On Windows, the removal policy is set per device. Microsoft documents the path through Disk Management → Properties → Policies [1]. Check the exact external drive rather than applying a rule remembered from another PC.

If Better performance is selected, use Eject/Safely Remove every time. Microsoft says this step is required to ensure cached operations finish; disconnecting without it risks data loss [1]. Microsoft Support also recommends selecting Eject and waiting for the safe-removal confirmation [2].

Do not change to Better performance merely to chase a benchmark without also changing the operating procedure. Faster cached writes and surprise removal are a poor combination.

Other hosts have their own rules

On macOS, Apple instructs users to eject through Finder, File → Eject or the Trash before disconnecting. If ejection is refused, a user or app may still be using files on the device [3].

Cameras, dashcams, phones, kiosks and industrial equipment often have no desktop eject icon. Use the host's documented stop/unmount function. If none exists, stop recording, wait for activity indicators to settle, and power the host off before removing the media. SanDisk gives the same power-off guidance for hosts without safe eject [4].

The conservative procedure is especially valuable for removable media used in the field, where operators cannot see internal writes.

A simple operating procedure for teams

For promotional USB drives, production loading stations and removable service media, document one repeatable sequence:

1. Finish the application task and close files stored on the device.
2. Wait for copy, sync, backup and scan activity to stop.
3. Select Eject/Safely Remove when the host provides it.
4. Wait for confirmation or for the device to disappear from the file manager.
5. If the host has no eject function, stop the workload and power it off.
6. Disconnect only after those steps.

For controlled Windows fleets, record which policy is deployed. For mixed hosts or customer-facing products, train users to eject: it is easier than asking them to identify caching policy correctly each time.

Where interrupted writes cannot be tolerated, removal discipline is only one layer. The storage design may also need suitable power-loss protection, journaling, atomic-update logic or redundant copies.

Bottom line

Windows Quick removal reduces one specific risk by disabling Windows disk write caching. It does not make active writes interruptible and it does not govern every host or firmware cache. If the policy and activity state are known, a quiet Quick-removal device can be disconnected without the Windows eject command. When anything is uncertain, eject—or power the host off—and wait.