When you “hot detach” a removable hard disk device from a Windows Vista-based computer, a Warning event that resembles the following may be logged in the System log:

Event ID: 12
The device device_name disappeared from the system without first being prepared for removal.

Additionally, if the disk is formatted by using the NTFS file system, a Warning event that resembles the following may be logged in the System log:

Event ID: 57
The system failed to flush data to the transaction log. Corruption may occur.

This problem may occur if the disk is “surprise removed.” For example, this behavior may occur if you remove the disk without using the Safely Remove Hardware icon in the notification area to stop the disk first. This problem may occur even though the disk uses an interface that supports surprise removal, such as a universal serial bus (USB) interface or an IEEE 1394 interface.