Get last successful boot time from a Windows hard drive

Question

I work for a company that has installers go into people's homes and set up their internet connection. In the past 2 weeks we have had a customer say that we broke their computer. Our installers aren't smart enough to see that they have a problem, stop, and inform the customer immediately.

What I'd like to do is set up a small live Linux CD that will mount all drives on the computer as read only and read the log files for the latest date that the computer was successfully booted, and if possible, connected to the internet. Any ideas as to which log files I might look at for the last successful boot on a Windows 2000, XP, Vista, and 7 machine?

Answer 1

I'm quite sure that Boot Logging has to be enabled to get a true log of the last succesfull Windows boot. The problem is that most people have this turned off.

One way that you can get a good reading is going through Window's event log to find the last successful start-up event.

Check out this post:

Is it possible to access the Windows event log if the system is unbootable?

Good luck!

Answer 2

Yes, it should be clearly listed in the Event Viewer if they have not deleted it. Few people would think to do so.

But, I don't think you will be able to do it from Linux if it is a proprietary format. Maybe that link shows otherwise, or WINE is a possibility.

But from a bootable Windows CD, like UBCD4Win, you could use Event Log Explorer to read the logs.