What does Windows error code 790 (ERROR_LOST_WRITEBEHIND_DATA_LOCAL_DISK_ERROR) mean?

ERROR_LOST_WRITEBEHIND_DATA_LOCAL_DISK_ERROR

Delayed-write data was lost because a local disk or removable medium failed the write.

ERROR_LOST_WRITEBEHIND_DATA_LOCAL_DISK_ERROR means that delayed-write data was lost because a local disk or removable medium failed the write. Dirty cached data could not be committed to local storage. The cause may be device removal, write protection, media failure, controller reset, file-system corruption, or a device reporting an I/O error after the application’s buffered write returned.

Where the result appears

• USB or removable media removed before safe ejection.
• local disks that develop I/O errors during cache flush.
• write-protected media receiving queued writes.
• storage stacks recovering from controller or bus resets.

What to collect

• device instance ID, volume, physical disk, and storage path.
• Disk, StorPort, NTFS/ReFS, and Kernel-PnP events at the same time.
• SMART or vendor health data and controller diagnostics.
• the final file size, checksum, and whether the medium was removed or locked.

Handling and recovery

Stop using the affected output as valid. Reconnect or replace the medium, clear write protection only when intended, run storage diagnostics, and write a fresh verified copy. On a fixed disk, prioritize backup because delayed-write loss can be an early sign of hardware or file-system failure.

Common misinterpretation

The data-loss message can appear after the original write call, so searching only the call site that issued WriteFile may miss the actual flush or device-removal event.

References

• Microsoft: System error codes 500–999