How does the computer know that the PC was not properly shut down?

Windows also uses the Dirty Bit method to detect whether the PC was shut down properly:

When powered off as normal, the bit is switched off. However, in case of power outage or improper (forced) shutdown, the bit will still be on the next time the PC is started.

This means that Windows can suggest remedial action - such as booting into Safe Mode.

In addition a Windows based PC will write an entry into event log detailing when and why (if known) it was shut down. It also writes an event when the PC starts up.

System shut down

System start up

When the PC restarts it can check the event log and if it doesn't find a "shut down event" after the last "start up" event it knows that the PC wasn't shut down properly and there may be issues due to unsaved data etc.


For non-Windows based PCs, the detection is usually done on a per-filesystem basis. When a filesystem is mounted in read/write mode, an entry is written to the filesystem marking it dirty. When the filesystem is unmounted, an entry is written marking it clean. On startup, the operating system checks if its core filesystems are marked dirty, and if so it knows there wasn't a clean shutdown -- at least of those filesystems.


In Windows, according to the authors of Windows Internals, 5th ed., it is the bootstat.dat file (located by default in the \boot directory of the system partition):

Windows uses a boot status file ... to record the fact that it has progressed through various stages of the system life cycle, including boot and shutdown. This allows the Boot Manager, Windows loader, and the Startup Repair tool to detect abnormal shutdown or a failure to shut down cleanly and offer the user recovery and diagnostic boot options ...