Windows Registry ShutdownTime Key — Determining Last Boot Time
A forensic analyst is examining a Windows 10 system and needs to determine the last boot time of the system. Which registry hive and key should the analyst query to find this information?
Quick Answer
The correct answer is the SYSTEM hive, specifically the key `CurrentControlSet\Control\Windows\` and the value `ShutdownTime`. This works because the ShutdownTime value records the exact timestamp of the last system shutdown in Windows 10, and since a boot event immediately follows a shutdown, querying this value effectively reveals the last boot time. On the Computer Hacking Forensic Investigator CHFI exam, this tests your knowledge of core Windows registry artifacts for timeline analysis, often appearing in scenario-based questions about determining system uptime or correlating user activity with boot events. A common trap is confusing this with the `SYSTEM\Select` key, which tracks the last known good configuration but not shutdown timestamps. Remember the mnemonic: “Shutdown tells you boot” — the last shutdown time is the start of the next boot.
⚠ Common exam trap
EC-Council often tests the misconception that the SOFTWARE hive or NTUSER.DAT hive stores boot-related timestamps, but only the SYSTEM hive's 'CurrentControlSet\Control\Windows\' key contains the official 'ShutdownTime' value for determining last boot time.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SYSTEM hive, key 'CurrentControlSet\Control\Windows\', value 'ShutdownTime'
The SYSTEM hive stores system-wide configuration data, and the key 'CurrentControlSet\Control\Windows\' contains the 'ShutdownTime' value, which records the last system shutdown time. Since the last boot time is effectively the time after the last shutdown, querying this value provides the necessary information. This is a standard forensic artifact for determining system uptime and boot events on Windows 10.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
NTUSER.DAT hive, key 'Control Panel\Desktop\'
Why it's wrong here
NTUSER.DAT stores user-specific settings, not system boot information.
- ✓
SYSTEM hive, key 'CurrentControlSet\Control\Windows\', value 'ShutdownTime'
Why this is correct
The 'ShutdownTime' value in this key records the last system shutdown time, which can be used to infer the last boot time (as the system boots after shutdown).
- ✗
SOFTWARE hive, key 'Microsoft\Windows NT\CurrentVersion\'
Why it's wrong here
This key contains OS version info, not boot time.
- ✗
SAM hive, key 'SAM\Domains\Account\Users\'
Why it's wrong here
SAM hive stores user account details, not system boot time.
Go deeper
Related to this question
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CHFI
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Drag and drop the steps to perform a forensic analysis of a Windows registry using RegRipper into the correct order.
medium- ✓ A.Acquire registry hives, then run RegRipper with profiles, then analyze reports, then correlate findings
- B.Run RegRipper with profiles, then acquire registry hives, then analyze reports, then correlate findings
- C.Acquire registry hives, then analyze reports, then run RegRipper with profiles, then correlate findings
- D.Correlate findings, then acquire registry hives, then run RegRipper with profiles, then analyze reports
Why A: Registry analysis requires acquiring hives, running RegRipper with profiles, and correlating results.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.