I have been asked, how one can see, if a device has been clean booted. Here is an answer.
First, there is a registry key you can check:
[HKEY_CURRENT_USER\Performance]
"Last Boot Type"=dword:00000002
after a coldboot this value is 0. For warmboots the value is 2.
and another one
[HKEY_LOCAL_MACHINE\Comm]
"BootCount"=dword:00000005
The BootCount value starts with 1 at a cleanboot and counts with every reboot. This device had 1 clean boot and 4 warm boots.
These registry keys are easy to find with free tools like ssnap and WinMerge.
Another way to check for a clean boot is to look for a custom file or a custom registry entry in \Windows. With a cleanboot all contents is reset to the factory default (except for \Flash File Store (persistent storage) or external memory cards). If you created a file in \Windows or a value in the registry, these are gone after a cleanboot.
