DFIRHub

Windows event log ยท System105 Power source change

Logged when the power source changes (AC adapter plugged in or unplugged). Capacities are in mWh.

  • System
  • 2 fields
  • System.evtx
  • Microsoft-Windows-Kernel-Power

Notes

  • Logged when the power source changes (AC adapter plugged in or unplugged). Capacities are in mWh.
  • EvtxECmd 2026.10.0 and newer can also calculate the battery level (issue #99), with this Property block:
  • -
  • Property: PayloadData3
  • PropertyValue: "Battery: %Percent%%"
  • Values:
  • Name: Percent
  • Value: "round(/Event/EventData/Data[@Name=\"RemainingCapacity\"] div /Event/EventData/Data[@Name=\"FullChargeCapacity\"] * 100)"
  • It is not used here yet: older versions get this map with --sync, and drop the event when a Value is an expression.

Fields EvtxECmd extracts

2 columns in the EvtxECmd CSV

  • PayloadData1AcOnline: %AcOnline%
    • %AcOnline% = /Event/EventData/Data[@Name="AcOnline"]
  • PayloadData2RemainingCapacity: %RemainingCapacity% of %FullChargeCapacity%
    • %RemainingCapacity% = /Event/EventData/Data[@Name="RemainingCapacity"]
    • %FullChargeCapacity% = /Event/EventData/Data[@Name="FullChargeCapacity"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Power" Guid="331c3b3a-2005-44c2-ac5e-77220c37d6b4"/>
    <EventID>105</EventID>
    <Channel>System</Channel>
  </System>
  <EventData>
    <Data Name="AcOnline">False</Data>
    <Data Name="RemainingCapacity">56293</Data>
    <Data Name="FullChargeCapacity">62654</Data>
  </EventData>
</Event>

Source: evtx/Maps/System_Microsoft-Windows-Kernel-Power_105.map(opens in new tab) by Eric Zimmerman and contributors(opens in new tab), MIT License(opens in new tab)