How to determine the time of abrupt Linux shutdown?

I can't reply for Synology. But it's quite common for Linux distros to have syslogd/rsyslogd installed with a default configuration that insert lines like this in /var/log/messages :

Oct 11 23:58:48 harpe pppd[17995]: Exit.
Oct 12 00:16:08 harpe -- MARK --
Oct 12 00:36:08 harpe -- MARK --
Oct 12 00:56:08 harpe -- MARK --
Oct 12 01:16:08 harpe -- MARK --
Oct 12 01:36:08 harpe -- MARK --
Oct 12 01:56:08 harpe -- MARK --
Oct 12 02:16:08 harpe -- MARK --

So at least you have a maximal 20 minutes time window between entries in the logs.

Silly me, I forgot the obvious answer: depending upon your journalctl configuration, the command may remember a number of boots, and also the time of shutdown (even in case of unplanned, forced shutdown) :

journalctl --list-boots
 -3 ecfdfe641836413e8a6e5485e897fb09 Sun 2020-09-20 10:51:13 CEST—Thu 2020-10-01 12:59:33 CEST
 -2 940f4faaa25942d18315ea6534f76c5e Thu 2020-10-01 13:00:07 CEST—Tue 2020-10-13 10:46:14 CEST
 -1 9ad55bd7ab9a488fb76ace33915169cf Tue 2020-10-13 10:55:55 CEST—Wed 2020-10-14 10:26:12 CEST
  0 785a86203ec042dbb6ad8959166b0584 Wed 2020-10-14 10:34:26 CEST—Thu 2020-10-15 19:34:39 CEST

Your Synology is a linux based system. Which one I do not remember but that's not that important.

For that or any linux system, you want to review date & time of some reliable service in linux. The most reliable is probably auditd however you have to have that configured and running. If it is then you would look through /var/log/audit/audit.log and identify a gap in time followed by the expected sequence of messages that happen on power up. That is what would define your scenario of unexpected shut down.

For Synology, while based on linux, it is however the synology folks decided to configure their DSM (disk station manager) operating system which is realistically nothing more than how they have configured linux to operate the way they want it to with all their software piled on top of [debian] linux.

The other most likely thing to use in any linux is the /var/log/messages. I am not aware of anyone that's configured a reasonable distribution of linux where the messages file was not in use. In this you'll see many items per minute, so it should be quite easy and obvious to identify a time gap followed by what is normally seen in that file for a power on.

Synology DSM has a bunch of useful things in their control panel, it will have stated the date & time a power outage would have happened. I have a bunch of them, and their info log plainly states when the thing has been powered down normally or when the power cord was yanked from it. My guess is Synology's DSM parses audit.log or messages to make that determination.