Microsoft KB Archive/938940

= Event ID 12 and event ID 57 are logged in the System log when you &quot;hot detach&quot; a removable drive on a Windows Vista-based computer =

Article ID: 938940

Article Last Modified on 11/26/2007

-

APPLIES TO


 * Windows Vista Home Basic 64-bit Edition
 * Windows Vista Home Premium 64-bit Edition
 * Windows Vista Business 64-bit Edition
 * Windows Vista Enterprise 64-bit Edition
 * Windows Vista Ultimate 64-bit Edition
 * Windows Vista Starter
 * Windows Vista Home Basic
 * Windows Vista Home Premium
 * Windows Vista Business
 * Windows Vista Enterprise
 * Windows Vista Ultimate

-



SYMPTOMS
When you &quot;hot detach&quot; a removable hard disk device from a Windows Vista-based computer, a Warning event that resembles the following may be logged in the System log:

Event ID: 12

The device  disappeared from the system without first being prepared for removal.

Additionally, if the disk is formatted by using the NTFS file system, a Warning event that resembles the following may be logged in the System log:

Event ID: 57

The system failed to flush data to the transaction log. Corruption may occur.

This issue may occur if the disk is &quot;surprise removed.&quot; For example, this behavior may occur if you remove the disk without using the Safely Remove Hardware icon in the notification area to stop the disk first. This issue may occur even though the disk uses an interface that supports surprise removal, such as a universal serial bus (USB) interface or an IEEE 1394 interface.



RESOLUTION
To avoid this issue, we recommend that you use the Safely Remove Hardware icon in the notification area to stop the disk before you remove it.

Note If your configuration requires that you frequently surprise-remove the disk, we recommend that you do not enable System cache mode. For more information about System cache mode, click the following article number to view the article in the Microsoft Knowledge Base:

895932 Things to consider before you enable System cache mode in Windows XP



MORE INFORMATION
The NTFS file system uses transaction logging to provide a level of fault tolerance. In some cases, it may take as long as five seconds for a transaction log to be completed. Event ID 57 may be logged if the NTFS drive is disconnected before transaction logging is completed. In this scenario, data corruption may occur. If the drive is frequently surprise-removed, this increases the possibility that corruption may occur.

The FAT32 file system does not use this method of transaction logging. Therefore, event ID 57 is not logged when a FAT32 drive is surprise-removed.

Warning Regardless of the file system that is used on a drive, data corruption may occur if you disconnect the drive during a write operation.

For more information about the NTFS file system, visit the following Microsoft Web site:

http://windowshelp.microsoft.com/Windows/en-US/Help/5dd16a76-7224-45ed-946a-72d5c6dc6e821033.mspx

Keywords: kbtshoot kbnofix kbprb kbexpertiseinter KB938940

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.