Windows Shutdown Time

[rwiper]

The Windows registry records when the system was last closed down in the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Windows

under the ShutdownTime value. The shutdown value is stored using a binary value; to decode it to a readable form.