Can you determine exactly when iMac was disconnected from power?

Solution 1:

You want to find all files that are newer (based on time of last modification) than the .plist files you've already found. So if this is the name of the .plist file you already know about...

/Users/yourusername/Library/Preferences/whatever.plist

Then you want to use find like this:

find / -newermm /Users/yourusername/Library/Preferences/whatever.plist

You might see some lines like Permission denied -- just ignore those, it's fine.

This will search the whole disk for files accessed more recently than your comparison file. It might take a while. If you get many results, pick one of the results and try the find command again, substituting your newer file into the command. Rinse and repeat until you've found the newest file.

Solution 2:

You would need to look through the system log for the last "Shutdown Cause" code.

There won't be anything in cron because it was deprecated in favor of launchd. However, launchd (or cron) wouldn't be of help because those logs show when things are started or error out, seldom do they show when things are shutdown - especially if powered off properly (no error)

To search the log, use the following command:

$ log show --predicate "process == kernel" | grep -i "shutdown cause"

See this answer for further details on how to search the log.