Last Shutdown Time
When Windows last shut down cleanly, which bounds the timeline and dates the ShimCache.
Use it to bound the timeline with the last clean shutdown, and date the ShimCache written at that moment.
- SYSTEM
- System Information
What It Is
This value records when Windows last shut down cleanly, as a UTC timestamp. It bounds the timeline, because the machine was in use up to that point, and it dates the ShimCache, which Windows writes to the hive at the same moment. A crash or a power cut does not update it, so it can be older than the real end of use. It lives in the SYSTEM hive under Control\Windows.
What It Proves
The machine last shut down cleanly at that time, in UTC. The ShimCache in the hive was written at that moment.
What It Does Not Prove
A crash or power cut does not update it, so it can be older than the real end of use. On a running machine it shows the previous shutdown.
Where It Lives
Last Shutdown Time lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SYSTEM\C:\What It Looks Like
These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| Last clean shutdown 16 Oct 2026 18:47 UTC, when this hive's ShimCache was written. Anything later means another boot, so look for a crash or a live capture. |
| The old build last shut down 2 Sep 2026 at 22:10 UTC, the night before the upgrade. That closes its timeline and dates the ShimCache in its hive. |
How to Read It
Read the ShutdownTime value under SYSTEM\ControlSet001\Control\Windows, which holds eight bytes. Decode it with Registry Explorer's Data Interpreter as a Windows FILETIME, which gives the time in UTC. Artefacts written after it mean a later boot, so look for a crash or a live capture.
- When Windows Writes It
- At each clean shutdown or restart.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Registry Explorer, RECmd, RegRipper (shutdown)
Hunt It
This value keeps the time of the last clean shutdown, so read it from the SYSTEM hive, offline or live with Velociraptor. The System log records each shutdown and restart in events 1074, 6006 and 6008, which corroborate it.
Defender has no shutdown event. Read the key, or the System event log (1074, 6006, 6008).
Parse the Hive Instead
- Collect
C:\Windows\ System32\ config\ SYSTEM - Parse With
- Registry ExplorerRECmdRegRipper (shutdown)
Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Last Shutdown Time shows.
- Shutdown and Restart, System Events 1074 and 6006Not in the RegistryRecords every shutdown, and 1074 names the program and account behind each one.
- Unexpected Shutdown, System Event 6008Not in the RegistryRecords a crash or power cut, which this key never shows.
Sources
The facts on this page come from these public pages, which say more on each point.