last-sleep-and-wake-times.ps1

Get-WinEvent -LogName System -ErrorAction SilentlyContinue | 
    Where-Object { $_.Id -eq 1 -and $_.Message -like "*power s*" } | 
    Select-Object -First 5 | ForEach-Object {
        $msg = $_.Message
        
        # 1. Extract the raw string from the message
        $rawSleep = ([regex]::Match($msg, "(?<=Sleep Time: \s*).+?Z")).Value
        $rawWake  = ([regex]::Match($msg, "(?<=Wake Time: \s*).+?Z")).Value

        if ($rawSleep -and $rawWake) {
            # 2. Sanitize: Remove hidden LRM characters (Unicode 200E) and whitespace
            $cleanSleep = $rawSleep -replace '[^\x20-\x7E]', '' -replace '\s+', ''
            $cleanWake  = $rawWake  -replace '[^\x20-\x7E]', '' -replace '\s+', ''

            # 3. Truncate nanoseconds: .NET DateTime only supports 7 decimal places (ticks)
            # This regex looks for more than 7 digits after the dot and trims them
            $finalSleep = $cleanSleep -replace '(\.\d{7})\d+', '$1'
            $finalWake  = $cleanWake  -replace '(\.\d{7})\d+', '$1'

            [PSCustomObject]@{
                EventTimeLocal = $_.TimeCreated
                SleepTimeUTC   = [DateTime]::Parse($finalSleep)
                WakeTimeUTC    = [DateTime]::Parse($finalWake)
            }
        }
    } | Format-Table EventTimeLocal, SleepTimeUTC, WakeTimeUTC