please open sqlplus session and do...
show parameter background_dump_dest

What's the location Oracle points you?

Please check first and last entries on alert.log and correlate with the timing of your startup/shutdown activity.