Blog >> Last Shutdown

Investigating Last Shutdown

20/08/2022 Saturday

Windows registry stores system-wide configurations and changes. The last shutdown date and time are stored on the Windows registry. Capturing the last shutdown value from the registry key can provide valuable information during computer forensics investigations. This post will go through the Last Shutdown artifact on Windows systems.


Digital Forensics Value of Last Shutdown Artifact


Windows registry stores system-wide configurations and changes. The last shutdown date and time are stored on the Windows registry. Capturing the last shutdown value from the registry key can provide valuable information during computer forensics investigations. This post will go through the Last Shutdown artifact on Windows systems.


Location and Structure of Last Shutdown Artifact


The last Shutdown artifact is located at:

HKLM\SYSTEM\CurrentControlSet\Control\Windows\ShutdownTime

The figure below shows the details of the ShutdownTime key. The ‘ShutdownTime’ value is the binary date-time value of the latest shutdown of the system.


Analyzing Last Shutdown Artifact with ArtiFast Windows

This section will discuss how to use ArtiFast Windows to extract the Last Shutdown artifact from Windows machines and what kind of digital forensics insight we can gain from the artifact.

After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select the Last Shutdown artifact:






Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of the Last Shutdown artifact in ArtiFast.


Last Shutdown:This artifact shows the system’s last shutdown date/time. The details you can view include:



For more information or suggestions please contact: ummulkulthum.wambai@forensafe.com