How do I determine the exact time of reset, due to power loss?

Does Windows hold this kind of information?

There are two applicable events that you may find in the system event log, EventID 6008 and EventID 41.

The power loss will have occurred some time between one of these events and the previous event.

EventID 6008 may be more useful as it can include a timestamp (if the Persistent Time Stamp group policy setting is either enabled or not configured) showing uptime in seconds before the unexpected shutdown occurred.

Using this value together with the time stamp for the previous startup will enable you to calculate a time close to when the power outage occurred.

The previous startup can be found by looking for EventID 6005 The event log service was started.

If your system is battery powered (for example a laptop) you can find out exactly what time the power loss occurred. See my answer How can I find out when my laptop was last unplugged in windows 10? for a batch file which does this.


EventID 6008 The previous system shutdown at %1 on %2 was unexpected

Event Id: 6008

Source: Eventlog

Description: The previous system shutdown at %1 on %2 was unexpected.

Cause 1:

This event is written during startup following an unexpected restart or shutdown. An unexpected restart or shutdown is one that the system cannot anticipate, such as when the user pushes the computers reset button or unplugs the power cord.

If the Persistent Time Stamp group policy setting is either enabled or not configured, system information is written to the data section of this event. This information includes a timestamp that indicates the computers uptime in seconds before the unexpected shutdown occurred.


EventID 41 Kernel-Power

A critical error message that resembles the following is recorded in the event log:

Event ID: 41

Description: The system has rebooted without cleanly shutting down first.

Note: The values for the Stop error BugcheckCode and the BugcheckParameters can vary.

The kernel power event ID 41 error occurs when the computer is shut down, or it restarts unexpectedly. When a computer that is running Windows starts, a check is performed to determine whether the computer was shut down cleanly. If the computer was not shut down cleanly, a Kernel Power Event 41 message is generated.

An event 41 is used to report that something unexpected happened that prevented Windows from shutting down correctly. There may be insufficient information to explicitly define what happened. To determine what may have happened and to identify a potential resolution, it is important to know what the computer was doing at the time just before the event occurred.

If event 41 is logged because power to the computer was interrupted, consider obtaining an uninterruptible power supply (UPS) such as a battery backup power supply. An underpowered or failing power supply may cause this behavior. For example, if you added RAM or additional devices or hard disks when this problem began, the power supply may cause the problem.


You can't get an exact time, as the computer doesn't know when the power loss happened. You can determine a window, from the last log entries and an Event 41 (as DavidPostill put in his answer).


Assuming the computer powers on directly after, you can use one simple command to quickly find out when the computer was booted up:

net statistics workstation

This command will show a lot of information about network traffic, and at the very top, it will say: This computer is up and running since: date and timestamp.

If a UPS is present that caught the powerloss and as such the pc never stopped, this setting will not show that powerloss, which is what you are asking for. The powerloss, detected by the UPS will be shown in the eventlog if the UPS is connected using an USB cable though.

Another note, if the computer is rebooted after the powerloss, the latest reboot will be shown on this timestamp. This is not the best option therefor, but its the quickest if you are troubleshooting, which is why I decided to post an answer.

Tags:

Windows 8