Windows Fast Startup - How to determine when the last boot/reboot occured

Question

Is there some method in .Net I can use to ascertain when a Windows PC was last Shutdown when "Fast Startup" has been enabled on the PC. If the end user selects Shutdown rather than Restart, then none of the solutions I have found so far on StackOverflow give me that information.

"Up Time" and "LastBootUpTime" are NOT updated when a "Fast Startup" enabled Windows PC is put into Sleep mode or Shutdown.

In short - Is there some way to ascertain the last time the user "Shutdown" the computer?

Answer 1

You can filter the system event logs

To get all logs

foreach (var log in EventLog.GetEventLogs())
    if(log.Log == "System")
        foreach (EventLogEntry entry in log.Entries)

To get boot logs, filter the event ID with 6009 (mentioned by this answer )

(entry.InstanceId & 0x3FFFFFFF) == 6009

To get awake logs, filter the event ID with 1 and source with "Microsoft-Windows-Power-Troubleshooter"

(entry.InstanceId & 0x3FFFFFFF) == 1 && entry.Source == "Microsoft-Windows-Power-Troubleshooter"

Answer 2

Assuming you mean you want to find when the computer was last booted when fast-startup is enabled?

1. Query event log from .NET. Haven't done this but looks like you use System.Diagnostics.Eventing.Reader namespace [ from Googling :-) ]

2. Look for event id 27 (Boot event) and check boot type:

0x0- cold boot from full shutdown 0x1- hybrid boot (fast startup) 0x2- resume from hibernation

ie if it was a boot from fast startup then you need to look for event id 27 + boot type 0x1