The following registry key would be interesting to recover the system state. Why?

SYSTEM CurrentControlSet$\backslash$ControllCrashControllCrashDumpEnable

a$.$ Because it contains information about the times system has been shut down or restartec

b$.$ Because it informs if a dumpfile was created

c$.$ Because it contains information about the system upgrades

d$.$ Because it informs about failed log in attempts