cscript c:\windows\system32\eventquery.vbs /fi ID eq 6005 /l systemOver the years I have found system event log event 6005, The Event log service was started. to be the the most consistent entry after a computer restarts, even from a power outage, BSOD or other event.