Have a look at the event log. Click the Windows Orb (Start) > All Programs > Accessories, right-click Command Prompt then ‘Run as Administrator’. Copy & Paste or type wevtutil qe Microsoft-Windows-Diagnostics-Performance/Operational /f:text > %userprofile%\Desktop\Event.txt (note the five spaces) and press Enter. If you Copy & Paste the command, use mouse right-click to Paste it into the prompt.
Close the command prompt and double-click Event.txt on the Desktop to open it. Go to the end of the file (Ctrl+End) to see the most recent events. Those with an Event ID in the 200 series are shut down events.