How to Open and Analyze Dump Files on Windows

Quick Tips

• Types of Dump Files: Complete, Kernel, Small, and Automatic Memory Dumps.
• Locate the dump file (usually C:\Windows\MiniDump), choose your tool, and analyze the crash data.
• Two tools for the job: WinDbg and BlueScreenView.

Types of Dump Files on Windows

1. Complete Memory Dump: This memory dump records all the contents of system memory when your system hits a BSOD error. This dump contains data from the processes running when the memory dump was collected. 
2. Kernel Memory Dump: This dump file only stores data from kernel memory, meaning it doesn’t contain data from unused or unallocated memory or any memory allocated to user-mode programs.
3. Small Memory Dump: This dump file stores information that could help figure out what went wrong to cause the BSOD error. This file holds the Stop message and its parameters, a list of loaded drivers, and other details. 
4. Automatic Memory Dump: This dump file contains the same information as a Kernel Memory Dump. The difference between the two is not in the dump file itself but in how Windows sets the size of the system paging file. 

How to Change Memory Dump File Settings Using Windows Settings 

Step 1: Press the Windows key, type Settings, and click on Open.

Step 2: In the right pane, scroll down to About and click on it.

Step 3: In the Device specifications, under the Related link, select Advanced system settings.

Note: If you are on Windows 10, you will find Related settings instead of Related link, under which, select Advanced system settings.

The System Properties window will appear.

Step 4: Select Settings under Startup and Recovery.

Step 5: Now, under the System failure option, click on the drop-down menu of Write debugging information > select Automatic memory dump. Finally, click on OK.

This setting changes the details collected from memory dump files when a BSOD occurs. So, that you can view and understand the cause of the error. You may need to restart your PC to implement the changes effectively.

How to Analyze Windows Memory Dump Files 

1. Using WinDbg Preview

Step 1: Press the Windows key, type Microsoft Store, and press Enter.

Step 2: In the search bar, type WinDbg Preview, and press Enter.

Step 3: Click on Get to install WinDbg Preview.

Step 4: Once installed, press the Windows key, type WinDbg Preview, and click on Run as administrator.

Step 5: In the WinDbg Preview Window, go to File from the top menu.

Step 6: Select Start debugging > Open dump file in the right pane.

Step 7: Browse and locate the dump file > click on Open. 

Note: You can find the latest dump file in the root C:\ folder, C:\minidump, or C:\Windows\minidump folder.

Once you open the dump file, WinDbg loads it and runs. Depending on the file size, It may take time to process. 

Step 8: Now, type the below command in the command tab and press Enter.

! analyze -v

This command will start analyzing the dump file. This can take a few minutes to complete. Once it is complete, you should see the results in the top Window. With the result, you can troubleshoot the error that caused the crash.

2. Using BlueScreenView

This program scans and analyzes BSOD errors. It automatically picks up the Minidump directory dump file and processes it. Here’s how to install and run it.

Step 1: Download BlueScreenView > install and run it.

BlueScreenView auto-fetches the dump files from your system. If it didn’t, go to Options > click on Advanced Options > under the Load from the following MiniDump folder box, click on Browse > OK.

Step 2: Click on the dump files listed in the application.

The memory dump file selected will have a list of active files and drivers. The file highlighted in red will have a direct link to the cause of the BSOD error. You can click on it to troubleshoot the issue.

BlueScreenView is only useful to find the error causing the BSOD, unlike WinDbg, which also lets you debug the issue.

FAQs