Sunday, August 23, 2020

How to determine when was the last time the machine was rebooted from exported System Windows Event log

How to determine when was the last time the machine was rebooted from exported System Windows Event log

Exported System Windows Event log provides a ton of useful information for digital forensics. One useful information that might be of importance is knowing when was the last time that the machine was (re)started. 


To find when it was last (re)started, sort on the Date and Time column and then look for Source is Kernel-General and EventID is 12, see below for reference.


REF:3


No comments:

Installing CFFI on SBCL on Windows 11

Installing CFFI on SBCL on Windows 11 Version info: - OS: Windows 11 23H2 (Microsoft Windows [Version 10.0.22631.7079]) - Emacs: 30.2 - ...