TurnedOnTimesView by NirSoft is a lightweight, portable utility that extracts hidden power logs from the Windows Event Viewer to show exactly when a PC was active. 1. Download and Run Instantly
Zero installation required. Download the lightweight ZIP file directly from the NirSoft TurnedOnTimesView page.
Extract the folder. Unzip the contents using Windows File Explorer.
Launch as Admin. Right-click TurnedOnTimesView.exe and choose Run as administrator. This ensures the tool has the elevation required to parse complex system crash logs. 2. Decode the Color-Coded Power Grid
Green Indicators: Represents a clean, expected operating cycle where Windows shut down or restarted gracefully.
Red Indicators: Signals an improper shutdown. This usually implies a sudden power outage, a manual hard reset (holding the power button), or a Blue Screen of Death (BSoD).
Yellow Indicators: Highlights problematic, corrupted, or incomplete event log sequences that require deeper investigation. 3. Analyze the Core Session Metrics
Startup / Shutdown Time: Displays the exact timestamp down to the second when the system initiated and terminated.
Duration: Calculates the total consecutive uptime for that specific session.
Shutdown Reason & Code: Shows the official Windows event reason—crucial for finding out why an automated system rebooted.
Shutdown Process: Identifies the exact application or system executable (like winlogon.exe or mysqld.exe) that sent the shutdown command. 4. Audit Remote PCs and External Drives
Press F9. This opens the Advanced Options menu directly within the app.
Target Networked PCs: Change the Data Source to “Remote Computer” and type the name or IP address of another system on your local network to audit its uptime.
Analyze Dead Drives: Select “External Disk” as the source and point it to C:\Windows\System32\winevt\Logs on an external hard drive to perform forensics on a non-bootable computer. 5. Export Reports for System Audits How to know Windows did not shutdown normally – Super User
Leave a Reply