How does Windows 7 determine that a system was not shut down correctly (Kernel-Power Event ID 41) [duplicate]

Actually, this question struck me because of power cuts in my house. When there is a power cut, there is a sudden loss of power from the computer.

How does the computer know that the shutdown was not properly done?

Solution 1:

Windows also uses the Dirty Bit method to detect whether the PC was shut down properly:

When powered off as normal, the bit is switched off. However, in case of power outage or improper (forced) shutdown, the bit will still be on the next time the PC is started.

This means that Windows can suggest remedial action - such as booting into Safe Mode.

In addition a Windows based PC will write an entry into event log detailing when and why (if known) it was shut down. It also writes an event when the PC starts up.

When the PC restarts it can check the event log and if it doesn't find a "shut down event" after the last "start up" event it knows that the PC wasn't shut down properly and there may be issues due to unsaved data etc.

Solution 2:

For non-Windows based PCs, the detection is usually done on a per-filesystem basis. When a filesystem is mounted in read/write mode, an entry is written to the filesystem marking it dirty. When the filesystem is unmounted, an entry is written marking it clean. On startup, the operating system checks if its core filesystems are marked dirty, and if so it knows there wasn't a clean shutdown -- at least of those filesystems.