Solved

How does Windows determine unexpected shutdown time?

Posted on 2013-05-21
3
612 Views
Last Modified: 2013-05-21
Hello Experts

Does anyone know how Windows determines the time that a system shut down unexpectedly?  I'm guessing Windows does some sort of 'heartbeat timestamp' somewhere that gets cleared during a normal shutdown, and if Windows does not shut down cleanly, upon restart it will detect this uncleared timestamp and determine that it was the approximate time of the unexpected reboot.  The reason for my asking is because I need to know what the time interval might be between the 'heartbeat timestamps'.

Thanks for any help in advance.
0
Comment
Question by:Tuckrat
3 Comments
 
LVL 53

Accepted Solution

by:
McKnife earned 500 total points
ID: 39185760
0
 
LVL 87

Expert Comment

by:rindi
ID: 39185768
Most "unexpected shutdowns" are caused by system crashes, and they create dump files and events in the eventlogs. So either the time those dumps were created is output, or the time the eventlog was recorded.
0
 

Author Closing Comment

by:Tuckrat
ID: 39185819
Thanks for the quick answer.  This is exactly what I was looking for.
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

Suggested Solutions

When you upgrade from Windows 8 to 8.1 or to Windows 10 or if you are like me you are on the Insider Program you may find yourself with many 450MB recovery partitions.  With a traditional disk that may not be a problem but with relatively smaller SS…
Citrix XenApp, Internet Explorer 11 set to Enterprise Mode and using central hosted sites.xml file.
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now