Computer Repair · October 24, 2026 · ComputerKing Team

USB Drive Intermittent? Timing, Fake Capacity & Read-Only

A USB drive that appears and disappears, drops out during large transfers, or vanishes after waking from sleep is not necessarily dead. Disconnect timing, read-only lock and format loops each have different causes, and telling them apart is what protects your data.

Key Summary

A USB drive that appears and disappears, drops out during large transfers, or vanishes after waking from sleep is not necessarily dead. Disconnect timing, read-only lock and format loops each have different causes, and telling them apart is what protects your data.

Introduction: What This Guide Covers, and What the Basic Guide Already Covered

Our basic guide already covered the most basic checks, so this guide does not repeat them step by step. Instead, it uses disconnect timing as the main thread, working backwards from the symptom to the cause. In short, this round deals with the two most frustrating categories: intermittent behaviour, and drives that are recognised but cannot be used — drives that drop out halfway through use, drives that are recognised but cannot be written to, and drives that keep asking to be formatted.

Part One: Start with Disconnect Timing, Not with a Verdict That the Drive Is Dead

The same drive dropping out at different times can point to completely different causes. The table below separates the four most common timings, so readers can match their own symptom first and then go to the matching section.

One important test of elimination is this: if the drive works normally on another computer, the problem is more likely to be in the original computer's power settings, drivers or system updates, rather than in the drive itself. Conversely, if it fails on several computers with a known-good cable, the balance shifts towards a hardware problem in the drive. Running this comparison once can save a great deal of random trial and error.

Part Two: Vanishing After Sleep and Wake — Power Management Is the First Suspect

What USB Selective Suspend Is

Microsoft's official documentation explains that USB Selective Suspend lets the hub driver suspend individual ports without affecting other ports on the same hub, which is particularly useful for saving power on laptops. The feature is enabled by default, and Microsoft strongly recommends leaving it enabled. The reason is that a device that is not suspended can prevent the processor from entering deeper sleep states, which hurts power saving over time.

Official advice and practical troubleshooting are two different things, however. Microsoft's Q&A on devices not recognised after resuming from sleep suggests checking two places: first, the USB selective suspend setting in Power Options, trying it set to Disabled; and second, the Power Management tab of each USB Root Hub in Device Manager, checking whether "Allow the computer to turn off this device to save power" is ticked, and trying it unticked. It also warns that disabling it increases power use when the computer is asleep or hibernating and not plugged in.

On newer Windows 11 builds, Settings, Bluetooth and devices, USB includes a USB battery saver switch, described as stopping USB devices when the screen is off to help save battery. The USB battery saver switch, the Selective Suspend setting in Power Options, and the Power Management tab of each USB Root Hub in Device Manager are three different layers: the USB battery saver is the broader policy, the Power Options Selective Suspend setting is the system policy, and the per-Root-Hub setting is the per-controller layer. When troubleshooting, all three need checking; changing only one side does not count as having finished the check.

Disabling It Is Not a Cure-All

A 2026 guide warns that disabling Selective Suspend should be treated as troubleshooting for a specific problem, not as a tweak every computer needs. If disabling it brings no improvement, the original setting should be restored, and attention should turn to the cable, hub, drivers, firmware and power supply, rather than treating permanently disabling every power-saving setting as a solution. Permanently switching off all power-saving settings is not the safest approach. The right approach is targeted testing: keep a change only if it is confirmed to help, and otherwise revert it.

Shut Down and Start Again Is Not the Same Test as Restart

Under Fast Startup (hybrid shutdown), "shut down and start again" does not fully reload drivers. Only "Restart" discards the hybrid hibernation state, performs a full cold start, and loads the kernel and all device drivers from scratch. So "normal after a restart, still broken after shut down and start again" is itself a useful clue, not a random detail. When testing, try one restart and one shut down and start again separately, and note which one restores the drive.

There is another variable: Modern Standby changed how USB ports behave in low-power states, and in some states a port can still supply power to charge an external device. So, even with USB battery saver switched on, a port still charging after the screen turns off does not necessarily mean the setting has failed, and that detail alone should not be used to conclude the setting is useless.

Part Three: Power Supply, Hubs and Port Wear

How Insufficient Power Shows Itself

A USB 2.0 port generally supplies up to 500 mA, and a USB 3.x port generally up to 900 mA. Connecting a high-draw device to an under-powered port or an unpowered hub commonly shows up as repeated connect and disconnect cycles, sudden speed drops, or the drive disappearing. Manufacturer documentation says the same in its own words: when too many devices are connected to a passive (unpowered) hub, a power-exceeded error appears, and the advice is to switch to a powered hub, or to move the affected device from the passive hub to a port on the back of the computer. Another manufacturer's FAQ likewise advises removing some devices to see whether the offline problem goes away.

The possible mechanism behind unstable power is worth describing, but only as a possible mechanism, not as a guaranteed outcome: a voltage drop during a write can corrupt files, a current surge can reset the controller, unstable power can cause the drive to disconnect and reconnect, and a severe under-power event can push a solid-state drive into read-only mode or enumeration failure. This description comes from a single storage vendor's blog, not from an official standard, and readers should keep that distinction in mind.

The driver layer also carries variables. A 2026 guide notes that system updates sometimes replace chipset or USB controller drivers with generic versions that cooperate poorly with specific hardware. A Microsoft Q&A case describes a UASPStor warning after an update, meaning Windows lost communication with the drive and tried to force a connection reset, which could stall the whole system; troubleshooting included disabling Selective Suspend and disabling UASP for the individual device.

Port Wear Has Two Different Locations

Port wear has two different locations, and they should not be confused: wear on the cable plug, and looseness in the device port itself. In specification terms, a USB-C connector is designed to withstand up to 10,000 mating cycles, with insertion-force requirements before and after the durability cycles — but that is a specification ceiling, not a promise that nothing will loosen before 10,000 cycles are reached. USB-A is generally rated at around 1,500 mating cycles, and connector design places wear pressure on the cheaper cable end rather than on the device port end. So, when poor contact is suspected, suspecting the cable plug first is a reasonable starting point.

One guide notes that dust, lint or slight physical deformation of a port can cause a loose connection, and that electrostatic discharge can momentarily trigger a port protection circuit. This is a single guide's claim, and should be presented as one possible cause, not as a confirmed diagnosis. The practical signals are clear: if a drive only works when the cable is held at a particular angle, or if only one port fails while other devices work normally on that port, those are signals to replace hardware or have the port checked. While disconnections keep repeating, back up immediately, because a disconnection interrupting a write can corrupt the file system.

Part Four: Slower Does Not Mean Overheating, and Throttling Is Not the Same as Disconnecting

This section separates three phenomena that are constantly confused: slowing down, disconnecting, and slowing down after a fast cache fills up.

The Throttling Mechanism the Manufacturer States

Samsung's official description of the T7 is that Dynamic Thermal Guard activates during extended transfers when the product reaches a threshold temperature, automatically slowing transfer speed to provide a cooling period and prevent the product from reaching an excessive temperature. The official mechanism is throttling, not disconnection. Treating every slowdown as an overheating disconnection is misleading. Samsung also notes that the T7 uses an advanced thermal solution, keeping the product at its optimal temperature even at high speed, with surface temperature maintained below 45 degrees at all times under Samsung's internal quality standard.

On the other side, an enclosure with no heat path can push an NVMe controller into a thermal-protection shutdown, showing up as a sudden disconnection. This is an industry and vendor claim, not a manufacturer official document, and readers should keep the two source levels apart. Controller overheating, firmware instability, power sensitivity and sleep-resume errors are different causes in the same comparison, and should not be lumped together.

SLC Cache Filling Up Looks Like Overheating, but Is Not

A transfer that starts fast and then slows down is not necessarily overheating. Many solid-state drives use an SLC cache (a fast-write area) to absorb data first, and return to a lower sustained write speed once it fills. The sustained write speed of the same product can be far below its headline speed: for example, one external solid-state drive advertises speeds over 6,000 MB/s, but its sustained long-transfer write speed is listed as 1,350 MB/s for the 2TB version and 1,700 MB/s for the 4TB version. That comparison shows why "fast at first, slow later" alone does not prove overheating.

For practical identification, an assembly guide advises: if the enclosure feels hot and speed drops after a few minutes, check whether the thermal pad is properly in contact with the controller, and avoid placing the enclosure on a soft surface that blocks airflow. If the enclosure has no fan or heatsink, a long heavy load may call for an actively cooled model or a properly designed clip-on heatsink.

Part Five: Fake-Capacity Drives — Displayed Capacity Does Not Mean Real Capacity

How Fake Capacity Deceives

A fake-capacity drive has controller firmware rewritten to report a capacity far larger than its real flash memory, and the operating system has no simple way to verify real capacity from appearance alone. Beyond the real capacity, there are two common behaviours: written data becomes corrupted, all zeros or all ones; or new writes wrap back to the start of the drive, overwriting the file directory and making all files inaccessible. The most troublesome part is that files beyond the real capacity appear to copy successfully, but turn out corrupted or unreadable when opened later. This kind of failure happens silently, not with an immediate error.

A published case describes the same pattern: a drive reporting around 4 billion 512-byte sectors — its claimed capacity — while its real usable storage was only 58GB, with writes beyond the limit failing to store correctly. An implausibly low price for a large claimed capacity is itself a warning sign, and packaging quality and seller reputation are also worth noting. Readers should not assume any brand is particularly prone to fakes, as there is no brand-level reliable source for such a claim.

How to Verify Real Capacity

There is only one reliable principle for verifying real capacity: actually write data and read it back for comparison, not reading the number File Explorer shows.

On Windows, H2testw, a free tool published by the German computer magazine c't (Heise), can be used. It offers an English interface and needs no installation. Select the target drive, choose all available space, and press Write plus Verify; the program writes test files and reads them back for comparison. A good result reports that the test finished without errors, while a fake or damaged drive reports that the media is likely defective, listing the good capacity and the data-lost capacity. Note that testing takes a very long time; a large, slow drive can take a great while to finish, testing only part of the space can miss problems in the untested range, and drive data should be backed up before testing.

On macOS and Linux, the corresponding tool is F3, which works on the same principle: write test data first, then read it back for verification, and it is not fooled by the capacity reported by a tampered controller chip. The fastest test in the F3 suite is f3probe, which only writes the data needed for the test, operates directly on the unmounted block device, needs administrator privileges, and erases data when run in destructive mode. When it passes, it reports that the device is the real thing, listing usable size and announced size; if the two are not equal, there is a problem. On macOS, F3 can be installed through Homebrew, followed by the write and read commands.

A different kind of tool, which does not write data, is ChipGenius. It reads the controller and flash-chip information inside the drive — device name, vendor ID, product ID, serial number, USB speed, controller vendor and model, and flash ID — to identify the real hardware inside. When Windows shows only a generic device name, a suspicious capacity or no useful information, ChipGenius can reveal the controller model, leading to the matching controller-specific tool. Three warnings belong with it: first, ChipGenius triggers false positives on virus-scanning platforms because it uses low-level hardware access, and anyone concerned about that should not download it; second, ChipGenius's official website could not be verified, and version numbers differ across download sites, so download only from a trusted software library and do not rely on any self-described official site; third, apart from ChipGenius, every write-based test tool can destroy data still on the drive, so backup before testing is essential.

Smaller Displayed Capacity Does Not Always Mean Fake

A smaller displayed capacity has many possible causes, and should not immediately be blamed on malware or fakes. A drive previously used as a boot installation disk or rescue disk can leave a small partition or hidden partition behind, so File Explorer only sees the small partition. A large block of unallocated space in Disk Management means the main partition was deleted, shrunk or damaged. Partition-table damage, using only one small partition, file-system damage, fake capacity and physical damage can all make displayed capacity smaller than real capacity. The right order is to check partitions and unallocated space in Disk Management first, then judge whether it is fake capacity or a hardware problem, rather than treating a virus scan alone as a fix.

Repurposing a fake-capacity drive at its real smaller capacity only applies when the data is no longer important or already backed up. The F3 repair command can create a partition matching the real capacity based on the test result, but the system will still report the fake capacity, because the controller firmware has the false capacity written into it.

Part Six: Suddenly Read-Only — Work Through the Layers

A drive that suddenly becomes read-only can be separated into layers, from the simplest to the most serious, and worked through in order.

The first layer is a physical switch. Many drives and memory cards have a small physical lock switch; flipped to Lock, the drive becomes read-only, and flipping it back restores writing. Not all drives have a physical switch, however, and if no switch can be found, the problem should not be assumed to be the switch.

The second layer is system policy. In the registry, under the StorageDevicePolicies key, a WriteProtect value of 1 disables writing for all USB devices, and 0 restores writing. Group Policy also has a removable-storage access setting; enabling "Deny write access" for removable disks makes all removable disks unwritable. Another policy refuses writing to removable disks not protected by encryption, so only encrypted devices can be written to once it is enabled. If policy is re-applied by a company domain or device-management service, local changes revert after a restart, and only an administrator can change them. Before making any registry or policy change, back up the relevant settings first; if unsure, stop and do not work through the settings by guesswork.

The third layer is a software-level read-only attribute. DiskPart's clear-read-only command can clear the software-level read-only attribute, provided the controller still permits writing. Formatting only helps when write protection comes from a logical error; if it is hardware write protection or hardware failure, formatting cannot remove the restriction.

The fourth layer is a controller lock, and this is the layer that needs the clearest explanation. A manufacturer's forum explanation, quoted from the manufacturer, is that a drive enters write protection on its own when the number of good blocks falls below a preset threshold, to prevent data loss, and also when both the primary and secondary block copies are damaged. When a controller enters read-only fail-safe mode because flash memory has reported too many errors, it should be treated as read-only, its data copied out promptly, and the drive replaced; there is no genuine repair method. Unstable power can also push a controller into a safe read-only state, so testing with a direct connection to a rear motherboard port first is a possibility worth ruling out — but it should not be stated as a conclusion.

The test of elimination is straightforward: if the same drive can be written to on another computer, the problem is more likely to be in the original computer's policy, registry or security software; if it is read-only on several computers, it is more likely to be in the drive itself. If DiskPart, check tools and formatting all fail, stop, extract the readable data, and replace the device; continuing to attempt writes only increases the risk of data loss.

A Read-Only End State Is a Backup-and-Migration Window

This point must be stated plainly: a read-only end state is a window for backup and migration, not a signal that the drive is fixed and can keep being used long term. Many solid-state drives switch to read-only mode once their spare blocks are exhausted; old data can be read out for a while, but new data cannot be written. That time should be used to copy important files away and replace the device, not to keep using the read-only drive as everyday storage.

Part Seven: The Repeated Format Loop — Image First

What the Format Prompt Really Means

When Windows prompts that the disk in the drive must be formatted before it can be used, it means the system recognises the device but cannot read its file system, and is proposing to create a brand-new blank file system. Common triggers include being unplugged during a write, damaging the file system, or flash memory ageing so that the index portion cannot be read — while the files themselves often remain.

A file system is only an index and a directory. When the index is damaged, the system reports the whole drive as unreadable, even though the file data itself is still underneath. A quick format writes a brand-new blank index, overwriting the old index and making recovery harder. So, when the format prompt appears, the correct order is:

1. Press Cancel on the format prompt. Do not press Format, do not initialise, and do not run repair commands.

2. Stop all writing: stop downloads, synchronisation, repairs, initialisation and unnecessary writes, and note the model, reported capacity, partitions, encryption state and the exact error message.

3. Make a full sector-by-sector image of the drive onto another healthy drive first, and only perform recovery or repair on the image copy — never repair directly on the original drive.

4. Only format or re-partition once the data has been safely copied out, or once it is confirmed that there is no important data.

Why Check Tools Should Not Be Run on Suspect Hardware

Recovery tools are designed to copy good sectors first, skip bad sectors, return to retry them later, and support resuming from a log file; they do not modify the original drive's file-system metadata. Professional guides state that running file-system repair tools on physically damaged media is the wrong tool and accelerates data loss. The correct approach is to copy the failing drive to a healthy target drive of equal or larger capacity first, and only run check tools on the copy — never on the original.

Another risk is that, if the USB bridge controller disconnects midway through a scan, a check tool can damage the file-system master table while writing, leaving the whole partition unmountable. USB external devices, going through a USB bridge, are more exposed to this. The boundary for the exception should also be stated: if the drive is stable, shows no sign of hardware failure, and the data is already backed up or unimportant, a check tool remains a common logical repair step. But once disconnection, freezing or repeated errors appear, stop and take the imaging route.

RAW versus Unallocated, in Brief

If Disk Management shows the correct capacity but marks the drive RAW, the partition is still present but its file system is damaged or unrecognisable; if it marks the drive Unallocated, there is no partition (the main partition was deleted, shrunk or damaged). If it shows no media, zero bytes or a wrong capacity, the controller firmware may already have collapsed, which is a hardware-layer problem. Repeated damage — fixed and then damaged again — is a warning sign of drive ageing or controller instability; it should not be handled by formatting repeatedly to the bitter end. Save the data first, then replace the drive.

Part Eight: NAND Wear and Reading SMART Data

How Wear Happens

Each NAND memory cell can only be written and erased a limited number of times, called program and erase cycles. Writing is the main cause of wear; reading has a smaller effect. Wear comes from electrons tunnelling through the oxide layer during each erase, degrading the oxide until the cell can no longer reliably hold charge, producing bit flips and failure.

Typical program and erase cycle ranges differ by process; the figures below are ranges, varying by process — never a single definitive number: single-level cell around 100,000 cycles, multi-level cell around 10,000 cycles, triple-level cell around 1,000 to 3,000 cycles, and quad-level cell around 500 to 1,000 cycles. Quad-level cell must distinguish sixteen voltage states per cell, with extremely narrow error margins between states; even slight electron trapping or charge leakage can shift a cell's voltage signature into a neighbouring state and trigger a read error.

Controllers compensate for ageing in several ways: spreading writes evenly, error correction, and reserving spare blocks to replace failed blocks. NAND cannot be overwritten in place; when a file is modified, the controller must find an empty block, copy the unchanged data together with the new changes, and then erase the whole old block, a process that itself increases write amplification. For lifetime units, a typical 1TB consumer solid-state drive has a total bytes written rating of around 300 to 600 TB — a single-source claim that must be noted as varying by model, with individual product specifications taking precedence.

How to Read SMART Data Without Being Fooled by a Single Percentage

NVMe solid-state drive SMART fields can be formed into a checklist, but the limitation comes first: not all USB drives support SMART pass-through, and an enclosure or bridge chip can block SMART data, so not seeing SMART data does not necessarily mean there is no problem.

The single-percentage trap is worth stating with a case: one reported case showed a drive's health percentage still at 97 percent, while its media and data integrity errors had already reached over 75,000. The reason is that the health score is a weighted average of spare blocks, while the error count is a raw counter — looking at the percentage alone can mislead. That case figure is a warning only, not a general statistic.

Also, even a drive that is never used still degrades as charge gradually leaks, especially after years stored in a hot, humid environment, when an idle drive's data can be damaged. Flash drives are therefore unsuitable as long-term archival media without regular refreshing. At standards level, a consumer solid-state drive at the end of its rated life, unpowered at 30 degrees, is expected to retain data for one year, and an enterprise drive at 40 degrees for three months; a lightly used healthy drive retains data far longer than those figures.

Part Nine: macOS Short Comparison

For Mac users facing "recognised but unusable", the first step is to establish at which layer the drive is recognised. If the drive appears in Disk Utility but not in Finder, it may be unmounted, or Finder settings may be hiding external disks: first check Finder Settings, General, for the external disks option, or press Mount in Disk Utility. If Disk Utility does not show the drive at all, and System Information does not show it either, the problem is more likely hardware — the drive, enclosure, cable or port — and the cable, port and another computer should be tested.

Disk Utility's First Aid checks storage-device errors and attempts repairs. The standard order is to run First Aid on the lowest-level volume first, then work upwards through the container and the device itself. If First Aid finds errors it cannot repair, Apple's advice is to erase (format) the disk — an action that deletes content, so important files must be copied out or recovered first. Repeating repairs after First Aid fails can overwrite recoverable data, so the data-recovery route should come first.

One Mac-specific normal behaviour needs stating: macOS can read NTFS by default but cannot write to it. Files can be browsed, opened and copied to the Mac, but cannot be saved, edited, renamed or deleted directly on the NTFS drive. This is a design choice, not a system error. NTFS is Microsoft's proprietary format, and Apple only provides safe read-only support. Full read and write access needs a third-party NTFS driver, or copying the data out and reformatting to exFAT. Installing two NTFS drivers at the same time can cause mounting problems; only one should be installed at a time, and an old driver should be removed or disabled first.

Part Ten: When to Stop and Send It for Repair

Stop and do not retry further if any of the following appears: repeated disconnection or freezing, DiskPart, check tools and formatting all failing, First Aid reporting unrepairable errors, or the drive running hot, smelling strange or physically damaged. If a drive (only applicable to an external mechanical hard drive; a USB flash drive has no moving parts and makes no such noise) makes unusual noises, stalls or disconnects, software tools make the drive repeatedly read large areas, worsening damage, and important data should be professionally assessed first.

Before sending a drive for repair, prepare: the device itself, its original cable, the symptoms, what happened before the failure, and what has already been tried. If it is encrypted, have the password ready. If imaging it yourself fails, or the drive shows no response at all, professional routes include reading the NAND chips directly. For a fake-capacity drive read by chip-off, only data within the real capacity range can be recovered; overwritten portions cannot be brought back.

On Hong Kong local charges, this article lists no specific figures; actual charges require an individual quotation. One point readers should remember: no tool or method can bring back every file, and any claim of a complete recovery should not be taken at face value.

Common Misconceptions

Misconception one: changing the cable fixes everything. The cable is only one layer. The same symptom can come from wake failure, insufficient power, driver or firmware problems, controller overheating, NAND ageing or fake capacity. If disabling power-saving settings brings no improvement, restore the settings and check other layers, rather than concluding the cable is fine or swapping cables repeatedly.

Misconception two: disconnection means the drive is dead and should be thrown away at once. Disconnection can also come from system power policy, leftover Fast Startup driver state, an overloaded unpowered hub, or a device that works perfectly on another computer. The test of elimination is to check whether another computer works normally, and whether a restart removes the symptom, before judging whether it is a device hardware problem.

Misconception three: slower means overheating. Slowing down has three different mechanisms: sustained speed falling after the cache fills, manufacturer thermal-protection throttling, and power or driver problems. The manufacturer's official thermal-protection description is throttling for cooling, not disconnection, and a warm enclosure alone cannot prove overheating is the only cause.

Misconception four: recognised means undamaged, and write failure is only a file problem. A fake-capacity drive's controller makes the operating system believe the capacity is far larger than the real capacity; files written beyond the real capacity appear to succeed, then the data disappears after removal, with no error shown during writing. Testing must use actual write plus read-back verification, not the capacity File Explorer shows.

Misconception five: a healthy SMART reading means safe. The health percentage is only one number. Critical Warning, Available Spare, Percentage Used, Media and Data Integrity Errors and Unsafe Shutdowns should be read together as a trend, not as a single percentage snapshot.

Misconception six: disabling all power-saving settings is safest, and permanently switching them off does no harm. Microsoft strongly recommends leaving Selective Suspend enabled, because devices that are not suspended can prevent the processor from entering deeper sleep states. The right approach is targeted troubleshooting first, keeping a change only if confirmed effective, and otherwise restoring the original setting.

Misconception seven: formatting fixes everything. Formatting only replaces the file system and index; it does not repair flash hardware damage. For a hardware-faulty drive, formatting cannot remove write protection. A quick format mainly replaces the index, while a full format writes over more area and can further reduce recovery chances; neither repairs damage. Even if a drive looks normal after formatting, repeated damage will return if it is a fake-capacity or ageing controller.

Misconception eight: running check tools a few more times will fix it. Check tools repair file-system structure and metadata; they cannot repair physical flash degradation. If errors return quickly, the medium may already be unstable or near the end of its life. Running check tools on a drive with hardware errors can worsen damage; the right approach is image first, and repair only on the copy.

Frequently Asked Questions

1. A drive is sometimes recognised and sometimes not. What should be done first?

Note the disconnect timing first, then run two comparisons: test on another computer, and try a restart rather than shut down and start again. Those two comparisons already separate a system problem from a drive problem, and the table in Part One then points to the matching section.

2. After waking from sleep the drive disappears. Should all power-saving settings be permanently switched off?

No. Microsoft strongly recommends keeping Selective Suspend enabled, and disabling it should be treated as troubleshooting for a specific problem. If disabling it brings no improvement, restore the original setting and check the cable, hub, drivers, firmware and power supply.

3. Large transfers drop out, but small files are fine. What does that mean?

It points more towards insufficient power, a marginal cable, heat, a problem in the area being read, or a controller starting to fail. Retry the large transfer plugged directly into a rear port, and back up immediately while disconnections repeat, because a disconnection interrupting a write can corrupt the file system.

4. A drive suddenly became read-only. Can anything still be saved?

Work through the layers. A physical switch, system policy and software-level read-only attributes can be reversible causes, while a controller lock is a protection mechanism whose purpose is to protect the remaining readable data. On every layer, the first step is to copy out readable data; the read-only state itself is a backup-and-migration window, not a signal for continued long-term use.

5. Windows keeps asking to format. Should Format or Cancel be pressed?

Cancel should be pressed. The format prompt only means the system cannot read the file system; the files themselves often remain. The correct order is to press Cancel, stop all writing, make a full image onto another healthy drive first, and only work on the image copy. Only format once the data has been safely copied out, or once it is confirmed that there is no important data.

6. How can it be known whether a drive is fake capacity?

The capacity File Explorer shows comes from the controller's report, and fake-capacity drives work precisely by tampering with that report. The only reliable method is a full-capacity write plus read-back test: H2testw on Windows, and F3 on macOS and Linux. Back up before testing, because write-based tests can destroy data still on the drive.

7. SMART shows over 90 percent healthy. Does that mean the drive is still safe?

Not necessarily. The health percentage is a weighted average of spare blocks, while the error count is a raw counter. One case showed a health percentage still at 97 percent while media and data integrity errors had already reached over 75,000. Critical Warning, Available Spare, Percentage Used, error counts and Unsafe Shutdowns should be read together as a trend.

8. On a Mac, an NTFS drive can only be read, not written to. Is the drive broken?

No. macOS reads NTFS by default but cannot write to it; this is a design choice, not a system error. Full read and write access needs a third-party NTFS driver, or copying the data out and reformatting to exFAT.

Related Articles

• USB Drive Not Recognised? A Step-by-Step Guide: Power, Drivers, and Partitions — Before You Format Anything
• Hong Kong Backup Strategy Guide: The 3-2-1 Rule Done Properly — Time Machine, Windows, Cloud and Offline Drives
• SSD Failure Symptoms: 7 Warning Signs, SMART & Data Recovery

Sources

• Microsoft: USB Selective Suspend documentation
• Microsoft Q&A: USB device not recognised after resuming from sleep
• Windows 11 USB power management guide
• Windows 11 USB power settings step-by-step guide
• Windows 11 USB settings and notifications explained
• USB device disconnecting troubleshooting guide
• Windows USB Selective Suspend fix analysis
• Fast Startup switched off, bugs gone
• Microsoft Q&A: USB battery saver and Modern Standby
• DiskGenius: USB drive keeps disconnecting
• USB hub disconnecting disks or peripherals
• TP-Link hub offline FAQ
• Transcend hub power exceeded FAQ
• External SSD interface and controller limitations
• USB device keeps disconnecting fix guide
• Microsoft Q&A: update causes external drive lock-up case
• External SSD disconnecting randomly on Mac
• Portable M.2 NVMe SSD enclosure tutorial
• Engadget: USB device disconnecting reasons
• Samsung T7 product page: Dynamic Thermal Guard
• Samsung T7 US product page: thermal solution
• Why an external SSD is slow
• USB flash drive lifespan and failure analysis
• Wear levelling in flash memory
• Silicon decay: why SSD health declines
• How SSDs work and lifetime units
• NVMe SSD health monitoring and data recovery guide
• How to check SSD health in 2026
• SSD health report and read-only mode
• SSD secure erase internals
• The SMART data lie: 97 percent healthy and dying
• USB-C cable guide
• USB cable FAQ
• USB devices disconnecting fix guide
• The 2TB flash drive scam
• How to detect a fake SSD or flash drive
• That cheap 2TB USB drive is probably a scam
• How to test fake memory card capacity
• Fake flash drive case and protection tips
• Flash drives fail and shrink over time
• Restore a USB drive to full capacity
• Microsoft Community: USB capacity display discussion
• H2testw tool notes
• Heise H2testw download page
• Ways to test USB flash drive true capacity
• Test a USB flash drive for errors or fake size
• H2testw technical data page
• F3 read manual page
• Linux: check the physical health of a USB stick
• F3 USB capacity test commands
• Ubuntu Community fake USB capacity discussion
• Detect fake storage devices with ChipGenius
• ChipGenius software data page
• Test and detect fake USB flash drives
• Remove write protection from a USB drive
• USB security and write protection notes
• SanDisk forum: drive suddenly write-protected
• Media is write-protected USB notes
• Enable or disable USB write protection
• USB write protection, older guide
• Make a disk write-protected in Windows 11
• USB blocked by Group Policy troubleshooting
• Drive not accessible, format prompt analysis
• External hard drive asks to format
• SanDisk forum: drive keeps asking to reformat
• USB unreadable status: what can be done
• DIY hard drive data recovery
• Check tools and failing drive myths
• Data recovery flowchart
• ddrescue data recovery tutorial
• Linux data recovery methods
• Data recovery after drive failure tips
• Fix a corrupted flash drive without formatting
• Before sending a drive for repair
• External drive not showing on Mac
• Mac will not recognise an external hard drive
• External hard drive not showing on Mac, recovery routes
• APFS external drive not mounting on Mac
• macOS external hard drive recognition tips
• exFAT external drive will not mount on Mac
• How to use NTFS on Mac
• Can a Mac read NTFS
• Read and write NTFS drives on Mac
• Does NTFS work on Mac