Hi,
In autopsy, where can i have simply the information about the lasts shutdowns of the case ?
Thx
Well, you cannot directly, unless someone develop a module for it.
You can use the nirsoft tool: TurnedOnTimesView - https://www.nirsoft.net/utils/computer_turned_on_times.html. Extract the events from autopsy and process.
You will need to extract the event files, and process them externaly.
On nirsoft go to options, advanced options. Choose external disk as datasource. Open the system.evtx or SysEvent.Evt file and export the shutdown and startup times.