Is it safe to unplug an external drive from a Mac without ejecting? What Eject does and what happens if you skip it

What Eject actually does

When you save a file to an external drive, macOS does not necessarily write it to the drive that instant. It keeps recent writes in a memory cache and sends them to the disk a moment later, in batches, because that is much faster. The drive's own electronics do the same thing with their own cache. At any moment, there may be a few seconds of data that the Mac believes is on the drive but is not there yet.

Eject (the button in the Finder sidebar, ⌘E with the drive selected, or dragging it to the Trash) does three things in order. It flushes every pending write to the drive. It asks every app with a file open on the drive to close it, and refuses to continue if one will not. Then it unmounts the volume, marking the file system as cleanly closed. The whole thing is managed by diskarbitrationd, the process that notices drives being plugged in and handles mounting and unmounting. When Eject finishes, the icon disappears and the drive is safe to pull.

Unplugging skips all three. Anything still in the cache is lost. Any file that was half-written is left half-written. And the file system is marked as not cleanly closed, which is what the next mount has to repair.

What happens if you unplug without ejecting

Most of the time, nothing visible. If the drive had been idle for a minute, the cache was already flushed and no file was open, so the only consequence is the "Disk Not Ejected Properly" notification. That message is macOS telling you it did not get to do the clean shutdown; it is not telling you something broke.

The risky moments are when the drive is busy:

• You just saved or copied something. The last few seconds of that file may not have reached the drive. The file looks present but is truncated or corrupt.
• Time Machine is backing up. backupd writes thousands of small files and updates the backup's database continuously. Pulling the drive mid-backup can corrupt the backup set; Time Machine often repairs it on the next run, but sometimes it has to start a new backup from scratch.
• Spotlight is indexing. mds_stores writes its index onto the drive itself (in a hidden folder). Unplugging mid-index corrupts the index, which is harmless but means it starts again next time.
• The drive is exFAT or FAT32. These formats keep their file allocation table in a few critical blocks and have no journal. If the pull lands during a write to those blocks, the entire volume can become unreadable, not just one file. This is the common Windows-compatible format for drives sold in stores, and the case where "it has always been fine" eventually is not.

APFS and HFS+ (Mac OS Extended) are journaled: the file system keeps a log of what it was about to do, and replays or discards it on the next mount. A pulled APFS drive almost always mounts cleanly next time with only the in-flight file affected. That is a good reason to format a Mac-only drive as APFS. It is not a reason to skip ejecting, because the in-flight file is still lost.

"The disk wasn't ejected because one or more programs may be using it"

This is the message you get when step two of Eject fails: some process still has a file open on the drive, and macOS will not pull the volume out from under it. Finding which one is the whole game, and it is usually one of these.

• Spotlight, on a drive you plugged in recently. When a new drive is connected, Spotlight starts indexing it, and the indexer holds files open the whole time. This is the most common cause on a drive you have used for less than an hour, and one MacRumors user solved a stubborn case this way: "Just for the heck of it I added one of the drives to Spotlight Privacy and now it ejects without any error messages." The setting is System Settings, Spotlight, Search Privacy; drag the drive in. Spotlight then ignores it, which is fine for a backup or media drive you do not search.
• A Finder window showing a folder on the drive. Close it. Finder keeps the folder open for as long as the window is.
• Preview, QuickTime, Photos, Music, or any app with a document from the drive open. Close the document or quit the app. Photo and video editors are the usual ones; a MacRumors reply on an identical thread: "If any Adobe apps are open make sure you quit them before you attempt to eject any attached storage."
• Terminal with its current directory on the drive. Type cd and press Return, or close the window.
• Time Machine mid-backup. Wait for it, or click Skip This Backup in the Time Machine menu, then eject.
• A file sync app (Dropbox, Google Drive) with a folder on the drive. Pause syncing.
• fseventsd. fseventsd keeps a change log on every mounted volume. It is a normal holder and releases the moment the real holder (one of the above) is gone.

The technical way to find the holder is the Terminal command lsof followed by the drive's path (lsof /Volumes/MyDrive), which lists every process with a file open there. It needs no special privileges for your own processes, and the command column names the app. Most of the time, though, closing Finder windows and quitting the obvious app is faster than reading the output.

Disk will not eject: what to check, in order

How to eject a drive that will not eject, in order

1. Close Finder windows on the drive

   Any window showing a folder on the drive holds it open. Close them all, then try Eject again.

2. Quit apps with a document from the drive

   Preview, Photos, video and photo editors, Music, and anything you opened from the drive. ⌘Q each one, then Eject.

3. Check Time Machine and sync apps

   If Time Machine is backing up to this drive, let it finish or choose Skip This Backup from its menu bar icon. Pause Dropbox or Google Drive if they sync a folder here.

4. Wait a minute if the drive is new

   Spotlight indexing a freshly connected drive usually finishes within minutes for a small drive. If it is a large drive you never search, add it to Spotlight's Search Privacy list instead.

5. Find the holder with lsof

   In Terminal: lsof /Volumes/ followed by the drive's name. The first column names the app. Quit that app.

6. Force Eject only when the drive is idle

   When Eject fails, macOS offers Force Eject. Use it when nothing is copying, no backup is running, and you have tried the steps above. Expect the "Disk Not Ejected Properly" notice and nothing worse.

7. Last resort: log out, or shut down

   Logging out closes everything you had open on the drive. Shutting down unmounts every drive cleanly, so the drive is safe to pull once the Mac is off.

Is Force Eject safe?

Force Eject unmounts the volume even though something has a file open on it. It is safe in the common case where the holder is Spotlight, Finder or fseventsd: those are reading, not writing, and nothing is lost. It is not safe when the holder is writing: a copy in progress, a backup, an export saving to the drive. In that case Force Eject is exactly as risky as pulling the cable, because the half-written file is abandoned.

The test is simple. Look at the drive's activity light if it has one, check that no copy progress window is open, and check the Time Machine icon is not animating. If the drive is idle, Force Eject is fine. If you cannot tell, quit the likely app first, or log out. Howard Oakley's advice on the Eclectic Light blog is the right order: find what is holding the volume before you force anything, because forcing it is only harmless when you know what you are about to interrupt.

APFS vs exFAT: which drive survives a pull

If you move a drive between a Mac and a Windows PC, it is probably exFAT, and exFAT is the format most likely to be ruined by an unclean unplug. It has no journal and no second copy of its allocation table, so a pull during a write to the wrong block takes the volume with it. Disk Utility's First Aid can sometimes repair it; sometimes the only fix is to erase and start again from a backup.

If the drive is used only with Macs, format it as APFS (Disk Utility, Erase, Format: APFS). APFS is journaled and copy-on-write, so a pulled drive comes back to the last consistent state on the next mount. Only the file being written at that moment is affected. Time Machine drives should be APFS on any Mac running Big Sur or later for the same reason.

Regardless of format: eject. It costs two seconds, it is the only step that guarantees the cache is flushed, and it is the difference between "Disk Not Ejected Properly" being a notification and being a problem. If a drive refuses to eject every single time and lsof keeps naming Spotlight, add the drive to Search Privacy and the problem goes away for good.