Why are large amounts of data from an HDD accessible minutes after unplugging it?

Question

I expect this has to do with caching, but the amount of time and data, and the lack of error messages, has surprised me. This is not an SSD.

A Windows-10 system that I have seen myself (through TeamViewer) has a removable hard drive and some 300 GB of data in it. It seems to be NTFS formatted (I forgot to check, but at least Windows 10 shows that all files are compressed). The device can be "safely removed"; however, if one removes the HDD "unsafely", data on the drive can still be accessed. This is not surprising in itself, as I would expected the Windows explorer to do some kind of caching of at least the folder structure. BUT:

• Folder and subfolders can be browsed for minutes after the removal (basically until Windows notices the drive is gone).
• Subfolders with photos are shown with the correct thumbnails (well, Thumbs.db, right), ...
• ... but Photos can also be opened in a non-Windows photo viewer.
• Folders can be renamed, and the operation seems to succeed.
• And finally, I was able to copy a 200MB+ executable from the root directory to the Desktop, and verify that it is in fact an executable (Embedded icon, MZ, "Cannot be run in DOS mode", stuff like that - I did not dare run someone's SFX executable).

Is this generally expected? I know read-caching exists, but are the numbers expected (several minutes, several 100 MB, several dozen subfolders, ...)? Could this be the result of unwanted software or some system setting?

The reason I am investigating this is because the same system is reported to "forget" file system changes after rebooting (such as renaming a folder, rebooting, and finding the folder having the old name); or behaving weirdly after renaming objects (such as renaming a folder and soon after copying it, which is reported to have failed). Both issues are congruent with write-cache malfunctions, but we were unable to reproduce them.

I will have access to said computer in the coming days, so answers do not have to remain hypothetical.

Answer 1

1. Windows caches the file structure to greatly speed access, particularly on a disk that has removal policy set to Better performance.

2. In the dialog above, it states explicitly that the *Quick removal [policy]... [d]isables write caching. This reduces the risk of losing data, but dos not completely eliminate the risk if a user were to hold the power button down to force shutdown or if the drive were to be unplugged while writing. Most likely, the user failed to Safely Remove hardware and Eject Media before removing the drive.