DFIRHub

Windows event log ยท System42 Sleep/wake events

  • System
  • 1 field
  • System.evtx
  • Microsoft-Windows-Kernel-Power

Fields EvtxECmd extracts

1 column in the EvtxECmd CSV

  • PayloadData1Reason "%Reason%"
    • %Reason% = /Event/EventData/Data[@Name="Reason"]

Value lookups

Codes that EvtxECmd turns into text

Reason

0
Button or lid
2
Battery
4
Sleep initiated by user from Start Menu
6
Hibernate from sleep - Fixed timeout
7
System idle

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Power" Guid="331c3b3a-2005-44c2-ac5e-77220c37d6b4"/>
    <EventID>42</EventID>
    <Version>3</Version>
    <Level>4</Level>
    <Task>64</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000404</Keywords>
    <TimeCreated SystemTime="2019-07-23 16:07:17.6831355"/>
    <EventRecordID>1189</EventRecordID>
    <Correlation/>
    <Execution ProcessID="4" ThreadID="8112"/>
    <Channel>System</Channel>
    <Computer>DESKTOP-LOJVG3N</Computer>
    <Security/>
  </System>
  <EventData>
    <Data Name="TargetState">4</Data>
    <Data Name="EffectiveState">4</Data>
    <Data Name="Reason">0</Data>
    <Data Name="Flags">4</Data>
    <Data Name="TransitionsToOn">1</Data>
  </EventData>
</Event>

References

3 links

Source: evtx/Maps/System_Microsoft-Windows-Kernel-Power_42.map(opens in new tab) by Eric Zimmerman and contributors(opens in new tab), MIT License(opens in new tab)