Data Recovery Case File · Solid State & Flash · What Eject Actually Does

Portable SSD Removed Without Ejecting: What Eject Does

Her enquiry was precise about the cause and had already been given an encouraging second opinion. A Samsung T5 portable SSD: "I plugged it into another laptop and removed it without pressing eject, and it now can't be read. I've been told it should be possible to recover the contents." Whoever told her that was right, and this page explains why — along with something specific to solid-state drives that makes unsafe removal a slightly different event on an SSD than on a memory card. Because an SSD is not a passive box of storage. It is a small computer with its own memory, its own bookkeeping and its own housekeeping to finish, and pulling the plug interrupts two sets of records rather than one.

The decode: two sets of records, not one

What ejecting actually does on the computer's side: it is not politeness. Operating systems do not write to external storage continuously — they hold recent changes in memory and commit them in batches, because that is dramatically faster. Ejecting instructs the system to flush everything still held, complete any operation in progress, and close the filesystem cleanly by marking it consistent. Remove the drive before that and the filesystem is left mid-update: directory entries partly written, allocation records disagreeing with one another, and a journal describing a change that never finished. The operating system then refuses to mount it, because mounting an inconsistent filesystem risks making it worse.

The part specific to an SSD: and this is what distinguishes her case from the same mistake on a memory card. An SSD maintains its own internal records — a mapping table translating logical addresses to physical flash locations, plus wear-levelling and housekeeping state — and it updates those continuously as it works. It also holds recent writes in its own cache before committing them. So an abrupt disconnect can interrupt the drive's private bookkeeping as well as the filesystem's, which is why an SSD pulled mid-write occasionally behaves oddly on reconnection rather than simply presenting a damaged volume. Modern drives are designed to survive this and usually do; it simply means there are two layers that can be left mid-sentence rather than one.

Why the outlook is good: nothing in that sequence erases anything. Interrupted writes damage the small records that describe where data lives; the data itself sits untouched. Reconstruction rebuilds those records on a write-blocked image, and the volume typically returns with its folder tree, filenames and dates intact. The confirmation she was given is sound.

One thing to establish, and one to refuse: portable drives of this class offer hardware encryption that can be switched on through the manufacturer's software, so whether it was enabled is worth confirming before anything is interpreted — an encrypted volume behaves differently from a damaged one and the two should not be confused. And whatever her computer offers next, the answer is no: scanning, repairing, initialising and formatting all write to precisely the structures a reconstruction rebuilds from.

On the bench

The drive was imaged write-blocked on the Atola TaskForce 2 in a single pass, so that every subsequent attempt happened against a copy and no repair could touch the original. The hardware-encryption state was confirmed before the volume was interpreted, since an enabled-but-locked drive and a damaged one look similar from outside and mean entirely different things. On the image the interrupted structures were reconstructed — the half-finished directory and allocation records resolved, and the journal's abandoned transaction unwound — until the volume mounted from the copy with its folders, names and dates as she had left them. Her files were verified by opening and delivered on fresh media.

The outcome

The volume rebuilt from a write-blocked image and the contents verified and delivered. Free assessment, one fixed written figure including VAT, no recovery, no fee. The decode, for anyone who pulled a drive out too soon: ejecting flushes writes still held in the computer's memory and closes the filesystem cleanly, so removing without it leaves the catalogue mid-update while your files stay physically intact — which is why the drive looks empty or unreadable and generally is not; an SSD adds a second layer, because it maintains its own mapping and cache and can be interrupted mid-update too; and the advice you were given is right, provided nothing writes to the drive in the meantime. Decline every offer to scan, repair, initialise or format it.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.