6005 is showing the start of logging events, but I assume it will also show up in case of any reboots, i.e. Windows does not make a difference between a 'full start-up' or warm reboot.
If the purpose is to seek the first startup and last closedown only, one has to remove any double 6005 entries.
With me, event id 12 is the very first one and event id 13 is the last one.
12: The description for Event ID ( 12 ) in Source (
Microsoft-Windows-Kernel-General ) could not be found. Either the
component that raises this event is not installed on the computer or
the installation is corrupted.You can install or repair the component
or try to change Description Server.
13: The description for Event ID ( 13 ) in Source (
Microsoft-Windows-Kernel-General ) could not be found. Either the
component that raises this event is not installed on the computer or
the installation is corrupted.You can install or repair the component
or try to change Description Server.
The following information was included with the event (insertion
strings): 2012-12-25T18:23:26.070181000Z
PS: That aside, I have a number of instances where a few 6005's were logged, but no 6006 that follows. One has to manually add the actual log-off based on e.g. the last eventlog entry that day.