How does Windows determine unexpected shutdown time?

Hello Experts

Does anyone know how Windows determines the time that a system shut down unexpectedly?  I'm guessing Windows does some sort of 'heartbeat timestamp' somewhere that gets cleared during a normal shutdown, and if Windows does not shut down cleanly, upon restart it will detect this uncleared timestamp and determine that it was the approximate time of the unexpected reboot.  The reason for my asking is because I need to know what the time interval might be between the 'heartbeat timestamps'.

Thanks for any help in advance.
Who is Participating?
McKnifeConnect With a Mentor Commented:
Most "unexpected shutdowns" are caused by system crashes, and they create dump files and events in the eventlogs. So either the time those dumps were created is output, or the time the eventlog was recorded.
TuckratAuthor Commented:
Thanks for the quick answer.  This is exactly what I was looking for.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.