Shut Down - View Details of Last Shutdown of Computer

I've had two unexpected shutdowns during the past 6 months & I did see these listed in the Event Logs. But I could not find anything about what caused them, such as power or HDD failure. Is there a way to get such information from the logs?

I followed the above steps & the only thing it said about my unexpected shutdown was that it was unexpected.

This problem happened with my HTPC which stays in the sleep mode except when being used. I knew nothing was scheduled to record at the time yet the LED indicated that it was awake. I turned on the TV & was greeted by a black screen with the message:
“Reboot & select proper boot device or insert boot media in selected boot device & press a key”.

There was no way to select anything. Pressing most keys just repeated the same message. Other keys did nothing. I have no idea how long it was in this state. I had to power off the PC & startup again. I got the usual BIOS screen asking to select Safe Mode, Normal Mode & a couple others. Normal Mode was the default & there is a count down timer that if nothing is selecting the PC will start in normal mode, which it did.

I looked at Event Logs at that time & the only thing that appeared related was an Error message at 3:23 AM: “The previous system shutdown at 3:23 AM on 12-17-2012 was unexpected.” But I could not find anything indicating what caused the shutdown.

FWIW Norton Internet Security’s history listed “LiveUpdate Session Completed at 3:07 AM”. This makes me wonder if NIS caused a problem.

I read the “Blue Screen of Death (BSOD) Posting Instructions” and “How to Configure Windows to Create a Dump File when you get a BSOD”. However my system never had a BSOD. It had a black screen with the previously mentioned boot message. Would that still be considered a crash with any data to dump?

After I had the black screen issue I forced few different unexpected shutdown scenarios. I did this by powering off while in different modes using either the on/off button or the power supply switch. I tried to duplicate the black screen issue, but to no avail.

The Dump File directions state “If a second crash occurs and another complete memory dump (or kernel memory dump) file is created, the previous contents of the C:\Windows\MEMORY.DMP file are overwritten.”

Wouldn’t my forced shutdowns overwrite the contents from the original problem shutdown?

Would it be better to configure Windows to create a Dump File in case my problem occurs again?

Realy good Brnik,
It help me a lot

HI, Nice article brink. But if there is not a proper shutdown or shutdown hangs, where to look for the logs, or which event id to be typed in the event id column of current log dialog box.
would it be possible. As it was power off by force, not usual shutdown. If i choose the same, id 6008 as in your example, it does not list anything. But i was having trouble in shutting down.