last reboot | less

last -x | head | tac

Examples of output:

runlevel (to lvl 0)   ... <-- first the system shuts down (init level 0)
reboot   system boot  ... <-- afterwards the system boots
runlevel (to lvl 2)   2.6.24-... Sat Sep 10 11:07 - 11:01 (2+23:34)

runlevel (to lvl 3)   ... <-- the system was running since this momemnt
reboot   system boot  ... <-- then we've a boot WITHOUT a prior shutdown
runlevel (to lvl 3)   3.10.0-693.21.1. Sun Jun 17 15:40 - 09:51  (18:11) 

Disk space remains the same pre and post file deletion. It is likely a process is still using the deleted file. To get a list of deleted files which are still marked open by processes:

lsof +L1

COMMAND PID USER   FD   TYPE DEVICE SIZE/OFF NLINK    NODE NAME
tuned   111 root    7u   REG  202,2     4333091     0 2141 /tmp/jar_cache23323.tmp (deleted)

Simply kill the process to dump the file in question:

kill -9 111

ps -o rss -C httpd | tail -n +2 | (sed 's/^/x+=/'; echo x) | bc

find /path -printf '%T+ %p\n' | sort -r | head