Event ID 12 and event ID 57 are logged in the System log when you "hot detach" a removable drive on a Windows Vista-based computer

When you "hot detach" a removable hard disk device from a Windows Vista-based computer, a Warning event that resembles the following may be logged in the System log: Additionally, if the disk is formatted by using the NTFS file system, a Warning event that resembles the following may be logged in the System log: This issue may occur if the disk is "surprise removed." For example, this behavior may occur if you remove the disk without using the Safely Remove Hardware icon in the notification area to stop the disk first. This issue may occur even though the disk uses an interface that supports surprise removal, such as a universal serial bus (USB) interface or an IEEE 1394 interface.

To avoid this issue, we recommend that you use the Safely Remove Hardware icon in the notification area to stop the disk before you remove it.

Note If your configuration requires that you frequently surprise-remove the disk, we recommend that you do not enable System cache mode. For more information about System cache mode, click the following article number to view the article in the Microsoft Knowledge Base:

The NTFS file system uses transaction logging to provide a level of fault tolerance. In some cases, it may take as long as five seconds for a transaction log to be completed. Event ID 57 may be logged if the NTFS drive is disconnected before transaction logging is completed. In this scenario, data corruption may occur. If the drive is frequently surprise-removed, this increases the possibility that corruption may occur.

The FAT32 file system does not use this method of transaction logging. Therefore, event ID 57 is not logged when a FAT32 drive is surprise-removed.

Warning Regardless of the file system that is used on a drive, data corruption may occur if you disconnect the drive during a write operation.

For more information about the NTFS file system, visit the following Microsoft Web site: