How-To Geek

How Does a Computer Know When It Wasn’t Properly Shut Down?

When you start your computer up after an improper shutdown/system crash, it will usually suggest actions like booting into safe mode and running a disk check. How does the computer know it crashed?

Today’s Question & Answer session comes to us courtesy of SuperUser—a subdivision of Stack Exchange, a community-drive grouping of Q&A web sites.

The Question

SuperUser reader FrozenKing wants to know how his computer knows when it has crashed or otherwise had an improper shutdown. He writes:

Actually, this question struck me because of power cuts in my house. When there is a power cut, there is a sudden loss of power from the computer.

How does the computer know that the shutdown was not properly done?

It’s an interesting question; clearly modern operating systems are well aware that something has gone wrong, but by what mechanism are they made aware?

The Answers

SuperUser contributor David Schwartz offers a general answer and insight into different operating systems:

For non-Windows based PCs, the detection is usually done on a per-filesystem basis. When a filesystem is mounted in read/write mode, an entry is written to the filesystem marking it dirty. When the filesystem is unmounted, an entry is written marking it clean. On startup, the operating system checks if its core filesystems are marked dirty, and if so it knows there wasn’t a clean shutdown — at least of those filesystems.

Another contributor, ChrisF answers more specifically for the Windows operating system:

Windows also uses the Dirty Bit method to detect whether the PC was shut down properly:

When powered off as normal, the bit is switched off. However, in case of power outage or improper (forced) shutdown, the bit will still be on the next time the PC is started.

This means that Windows can suggest remedial action – such as booting into Safe Mode.

In addition a Windows based PC will write an entry into event log detailing when and why (if known) it was shut down. It also writes an event when the PC starts up.

Have something to add to the explanation? Sound off in the the comments. Want to read more answers from other tech-savvy Stack Exchange users? Check out the full discussion thread here.

Jason Fitzpatrick is a warranty-voiding DIYer who spends his days cracking opening cases and wrestling with code so you don't have to. If it can be modded, optimized, repurposed, or torn apart for fun he's interested (and probably already at the workbench taking it apart). You can follow him on if you'd like.

  • Published 01/15/13

Comments (17)

  1. Bikram

    How…? ‘Coz it’s a computer.. duh. LoL.
    People with low humor quotient – excuse.

  2. bn

    Hello HTG, “How Does a Computer Know When It….” So this means nothing is lost as long as you do the remedial action which is booting into safe mode? Thanks

  3. Albert

    Another interesting question is: Does is really damage the PC when you power it off without shutting it down?

  4. NSDCars5

    @Albert Once or twice a week, no. More than that, and yes. My old desktop (HCL Beanstalk-something) corrupted the whole HDD when it was shut down improperly. At that time it was formatting the HDD to install Windows 7 over XP.

  5. whizzed

    I’ve often wondered myself as it happens quite regularly where I live, thanks HG for the Info

  6. john3347

    In layman talk, it sees that there is remnants of an unclosed application remaining in the Ram when you reboot. The OS knows that it is because the application was not properly shut down.

  7. thegeekkid

    The main time a computer can be damaged when shutting down is when it is writing data to the HDD. If it is not fully written, it can be corrupted. If it is system data, you risk damaging the system to where it may or may not boot. Modern systems have safeguards built in to try and avoid this, but the more times that you do it, the greater the chance that you will damage the data which is why it doesn’t normally matter if you only do it every now and then. On a side note, in digital forensics, when you take a computer for evidence, you shut it down by pulling the plug; not by shutting it down properly. ;)

  8. SirVirtual

    If it was a Monty Python computer it would have naughty bits – LOL

  9. Enthusiast

    john3347, that is an inaccurate statement. RAM or the computers memory (other than storage devices, like hard disks and SSDs) cannot store information once power is removed. There can never be remnants of anything in the computers RAM after a power off or power loss of any kind. The “dirty bit” that is being talked about is stored in a location on the storage drive.

  10. Enthusiast

    thegeekkid, The forensics department may want to preserve for analysis those temporary files generated while the computer is operating that may be erased during a normal shutdown. Pulling the plug doesn’t give the operating system a chance to do normal file cleanup, which deletes temporary files, and maybe destroying evidence.

  11. Cody

    Anyone who was doing anything worthy of getting their PC taken in for evidence and was smart enough would have the computer run a script or application on shutdown and/or boot that would wipe the data in question which is why they just pull the plug in those instances also.

  12. WhytteDragun

    @john3347: RAM is volatile memory, so when a PC loses power or is turned off (properly or not) all information that was in RAM is gone. There is absolutely nothing left. Only information written to non-volatile memory like a hard drive is kept through a power loss.

  13. thegeekkid

    I didn’t see he said RAM, but yes it would be on the HDD. And @Enthusiast, that is why I said you would just pull the plug.
    @Cody, it’s rare (most criminals are pretty stupid), but it does happen. 90% of the time at the most they emptied the recycle bin. (Didn’t even bother an overwrite… even after 1 or 2 overwrites you still have ghosting that can be recovered)

  14. bedlamb

    SirVirtual —If it was a Monty Python computer it would have naughty bits – LOL—
    And if your PC was named Renée Zellweger, or Bridget Jones, it would have ‘wobbly bits’.

  15. mkcoboe

    Yes RAM is volatile – lose power and you lose the data stored in it. I am a retired geek who started his computing career on machines which had no RAM as we know it today. The memory on the Ferranti Pegasus I cut my teeth on consisted of 55 nickel delay lines each of which held 42 bits, 39 data and 3 gap bits. Yes they were ACOUSTIC memory modules and we could make our computer “sing” when we got the timing right in our machine code programmes so that transfers of 8 words at a time to and from the magnetic drum store were synchronised with the rotation of the drum. That was volatile memory. Having put the data onto the delay line, the hardware had to catch it when it got to the other end and send it round again. Thats why we had 3 extra bits to a word. The burglar would have a job to get in and out of the house in a 30 second smash and grab raid because each delay line was on its own card plugged into the backplane so computers were big permanent installations.

    Then came core memory – that was non-volatile. Write your data in and it stayed there !! That was great until you read it and it then self destructed, so the hardware had to do an immediate write back after a read. The real advantage was that when power was lost by the action of the burglar, the forensics team or just yours truly tripping over the power cable, the contents were NOT lost. Power back up and it was still there and basically one could carry on as if nothing had happened. Great for the forensic scientist. Hard on the pocket because it was well expensive having to be hand made with wires threaded through a matrix of tiny magnetic cores across the rows, down the columns and diagonally as well. No wonder the early makers were recruited from the rag trade.

    Then came RAM (Random Access Memory) which is lost when power goes. Early RAM being capacitor based lost data in a (relatively) slow lingering death and so had to be regularly refreshed, like a delay line really, until latch based SRAM appeared (S=Static). Anyway, we have gone full circle in volatility together with a transformation in size and speed of access and we have gigabytes of memory on a tiny card the size of a finger.

    Well I am digressing. The important topic is about the “dirty” bit which is stored at the root of any partition used for directory structured data storage. That is an indicator that says that, on power up whether the directory structure is guaranteed OK (after a tidy shutdown or safe removal of a USB stick ‘disc’) or NOT OK (after yours truly tripped over the power cable, etc.) and so CHKDSK or CHKNTFS in today’s PCs is run to repair the directory structure and put on one side any areas of the disc which cannot be accounted for in the directories and storage allocation table to ‘orphan’ files. Corrupted files can occur and the real geeks can get to work to repair and reconstruct data files, unless of course some of it was out in the volatile RAM.

    Yes I have had directory structures laid out ‘on the floor’ in my time to try and recover vital stuff the user didn’t back up. Also I have written power off interrupt routines to write away a minimal important control registers as the electrical life blood dies away when I trip. Happy days !!

  16. john3347

    Do I have egg on my face. Thanks to all who corrected my mistake earlier. You are all correct and I was incorrect. Yes, anything in ram is gone if the computer is powered down, but the OS loading sequence sees that an application was not shut down properly as it is loading if that condition exists.

    My apologies to anyone who was misled by my incorrect information.

  17. spike

    To be completely accurate, it isn’t true to say that RAM doesn’t remember anything when it loses power. Actually, testing has been done, and it doesn’t forget everything right away, and the colder the memory is, the longer it takes to ‘lose it’s memory’. Just an interesting tidbit – don’t want to leave something inaccurate posted.

More Articles You Might Like

Enter Your Email Here to Get Access for Free:

Go check your email!