windows3-6  Exercise 1: Classify Every Unexpected Restart
=================================================================

Verification: Level 1 (run on the author's machine, read-only, no administrator rights).

Prediction (work this out before running the script):

  Before running: how many unexpected restarts do you think the System log holds, and how many of them
  were blue screens as opposed to power loss or hangs?

Commands (crash_timeline.ps1 saved in the current folder):

  .\crash_timeline.ps1
  '{0:X}' -f 314          # convert a decimal BugcheckCode to hex

Output (real, from the author's machine on 2026-10-24; your numbers will differ):

  2026-07-24 21:33:37  no stop code: power loss, hard hang or hard reset | no dump recorded
  2026-10-19 15:38:22  bugcheck 0x13A (P1 0x11) | last alive 15:21:33, 17 min before | dump 101926-16187-01.dmp
  2026-10-23 19:10:08  no stop code: power loss, hard hang or hard reset | last alive 19:03:59, 6 min before | no dump recorded
  2026-10-24 17:02:57  bugcheck 0x13A (P1 0x11) | last alive 16:50:21, 13 min before | dump 102426-15109-01.dmp

  13A      (the output of  '{0:X}' -f 314 )

WHY THIS WORKS AS AN ANSWER
---------------------------
  Four unexpected restarts. Two bugchecks, with BugcheckCode 314 decimal = 0x13A and first parameter 0x11
  (19 and 24 October), and two with no stop code (24 July and 23 October), which Microsoft's wiki says means
  power loss, a hard hang, a hard reset, or a failure before the code could be written.
  Minutes from the recorded shutdown to the event 41 time: 17 (19 October), 6 (23 October) and 13 (24 October).
  The 24 July event has no recorded shutdown in the log (the script prints nothing for it), so no gap can be
  stated; do not invent one. Event 41 is written at the next boot, so its time is when the machine came back,
  not when it failed.
  Common mistakes: reading the event 41 time as the time of the crash; searching for the decimal code (314)
  instead of the hexadecimal one (0x13A); and treating a code of 0 as "no problem" when it only means no code was recorded.