hello folks, Gracie here

I have been given a poorly laptop to sort out. Owner went out for a short while leaving machine on, when he came back it had shut down and he cannot get it to boot up again but keeps getting a 21A stop message, which tells him it is a fatal and that the logon process has been terminated and the system shut down.

I have looked on various sites, including MS to try and determine what the problem might be, but there is no one certain cause it seems, so I have to work it out for myself. I know I could just install another copy of the OS or upgrade, whatever, but if we do not know what caused the problem, we won't know how to stop it happening again, so here I am, in Recovery Console, about to fight the dragon.

I have all the directories listed.
I figure something must have automaticallyupdated while the owner was elsewhere, and that I ought to be able to find it by date, so here I am.

I have picked out all the entries dated 1.11.06, of which there are eleven, but I do not know quite what I am looking at.

The date is on the left of the screen
Then there is a column which I take to be the time, so 5:19p means 5:19 pm - zat right?
Then there are what I think are attributes; a -d -s - hs -c - r.
Is that right?
I don't know what they all mean however, so would appreciate your wisdom
Then there is a figure which I take to be size - but most of the ones on my list have a zero is that because they are folders rather than files?
Then there is the name of each entry.

the 1/11/06 ones are

.
..
NTServicePackUninstall
drivercache
fonts
help
inf
media
msagent
system32
winsxs.

NT Uninstall ServicePack is timed at 5:02
., .., drivercache and WinSxS are timed at 5:18
all the rest are timed at 5:19.

I also have two dates for today: ntbootlog.txt and bootstat.dat.

I think my next move will be to try and read the bootlog through the edit command, but if you can see a possible direction for tracking down the culprit, I would be pleased to know what you think