Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 74 down vote favorite
9

Actually, this question struck me because of power cuts in my house. When there is a power cut, there is a sudden loss of power from the computer.

How does the computer know that the shutdown was not properly done?

share|improve this question

3 Answers

up vote 91 down vote accepted

Windows also uses the Dirty Bit method to detect whether the PC was shut down properly:

When powered off as normal, the bit is switched off. However, in case of power outage or improper (forced) shutdown, the bit will still be on the next time the PC is started.

This means that Windows can suggest remedial action - such as booting into Safe Mode.

In addition a Windows based PC will write an entry into event log detailing when and why (if known) it was shut down. It also writes an event when the PC starts up.

System shut down

System start up

When the PC restarts it can check the event log and if it doesn't find a "shut down event" after the last "start up" event it knows that the PC wasn't shut down properly and there may be issues due to unsaved data etc.

share|improve this answer
1  
Isn't David's answer below more accurate? I thought NTFS had a 'dirty bit' which the FS detects when mounted. I have always assumed that the Event log is just a log of what is found rather than the actual detection and reasoning behind it? – HaydnWVN Sep 26 '12 at 9:21
@HaydnWVN - With Windows Server editions when you shut down you have to enter a reason so I thought it used that, but it could use the event log as a back up for the dirty bit. I'll have to do some more digging. – ChrisF Sep 26 '12 at 9:25
3  
But in an unplanned power-off situation (with no UPS obviously) the shutdown would be 'unexpected' (mentioned by Event log). Great info hereIf a program initiates an I/O operation that alters the structure of an NTFS volume - that is, changes the directory structure, extends a file, allocates space for a new file, and so on - NTFS treats that operation as an atomic transaction. It guarantees that the transaction is either completed or, if the system fails while executing the transaction, rolled back. – HaydnWVN Sep 26 '12 at 9:54
3  
@HaydnWVN The filesystem dirty bit is used to identify an abnormal dismount, so that the OS knows that the filesystem may be in an indeterminate state, and can run a diagnostic (e.g. chkdsk) to identify potential filesystem problems. This is why you get the repair dialog sometimes when plugging in USB drives that weren't properly removed. In contrast, the term "dirty bit" simply means a field that is set, and unset later when proper termination of the system or device runtime occurs. An improper termination leaves the field set, so it is recognised upon the next initialisation of the device. – Polynomial Sep 26 '12 at 15:09
1  
@ChrisF That requirement can be switched off in group/local policy. And will be bypassed if switched off via something like a VM host's control panel. Better to rely on events Kernel-General #12 (normal shutdown) and EventLog #6002 (last shutdown was unexpected). If it was a BSOD there should be a BugCheck #1001 as well. (All events: source #id.) – Richard Sep 26 '12 at 15:23
show 3 more comments
up vote 106 down vote

For non-Windows based PCs, the detection is usually done on a per-filesystem basis. When a filesystem is mounted in read/write mode, an entry is written to the filesystem marking it dirty. When the filesystem is unmounted, an entry is written marking it clean. On startup, the operating system checks if its core filesystems are marked dirty, and if so it knows there wasn't a clean shutdown -- at least of those filesystems.

share|improve this answer
21  
+1 because the question is not asking about a specific OS. – Trevor Boyd Smith Sep 26 '12 at 12:54
up vote 31 down vote

In Windows, according to the authors of Windows Internals, 5th ed., it is the bootstat.dat file (located by default in the \boot directory of the system partition):

Windows uses a boot status file ... to record the fact that it has progressed through various stages of the system life cycle, including boot and shutdown. This allows the Boot Manager, Windows loader, and the Startup Repair tool to detect abnormal shutdown or a failure to shut down cleanly and offer the user recovery and diagnostic boot options ...

 

share|improve this answer
1  
Source of quote? – Paul DelRe Sep 26 '12 at 21:21
14  
"Windows Internals" by Mark Russinovich and David Solomon with Alex Ionescu, page 1010. – artm Sep 26 '12 at 21:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.