When the system was shut down and restarted

1. Open Event viewer -> Windows Logs -> System
2. Filter Current log -> "<\All event IDs>" replace it with "6006,6005"

6005 -> Tells you the time machine started
6006 -> Tells you the time machine shut down