If you are a Windows user, chances are you have encountered the Blue Screen of Death (BSOD) error. The main difficulty with BSOD errors is that they have many different error codes to understand let alone analyze and troubleshoot. The details of a BSOD or Windows problem are in a file called a memory dump file that we will discuss later in this article. So you might have a dump file but not being able to open it and analyze it in detail is of no use. In this article, we will show you how to open and analyze dump files on Windows.
Now, let’s go back to the previous BSOD error. BSOD occurs for a variety of reasons, such as corrupted drivers, outdated firmware, and other software-related problems. So when it happens you will see a flashing blue screen with error code and some other details before Windows restarts.
Yes, the blue screen with the error code displayed is on purpose. These crash error details do not go away. Instead, they are saved in the Windows log so that they can be viewed and edited later. And these logs are called memory dump files, because they are saved in the .dmp file format. Now that you know what .dmp files are, let’s learn their types.
Dump File Types on Windows
So there are four types of dump files that Windows generates.
1. Complete memory dump
As it sounds, this memory dump logs all the contents of system memory when your system encounters a BSOD error. This dump contains data from running processes when the memory dump is collected.
2. Kernel memory dump
This dump file only stores data from kernel memory, that is, it does not contain data from unused or unallocated memory or any memory allocated to user-mode programs. Also, this dump file is smaller than the complete memory dump.
3. Small memory dump
This dump file stores the smallest amount of useful information that can help find the cause of the BSOD error. This file contains the Stop message and its parameters, a list of loaded drivers, and other details.
4. Automatic memory dump
This dump file contains the same information as a ‘Kernel Memory Dump.’ The difference between the two is not in the dump file itself, but in how Windows sets the size of the system paging file.
Wondering what a paging file is? Page files, also known as paging files, are used to aid in system crash dumps and to make physical RAM more efficient by moving the file’s contents to the hard drive as the system’s memory almost full.
Now that you understand the types of memory dump files and the detailed information they carry, you know how important the BSOD or Windows crash data is. The more data, the better. And the best part is that you can change the memory dump file settings to increase the detail collection.
How to change memory dump file settings using Windows settings
Changing Memory Dump file settings is pretty straightforward, especially using Windows Settings. Windows automatically creates memory dump files; however, you can set the granularity. That said, let’s jump into the steps.
Step 1: Press the Windows key on your keyboard, type Settingand click Open.
Step 2: In the right pane, scroll down to About and click on it.
Step 3: Under Device Specifications, under the Related link, select ‘Advanced system settings’.
Note: If you are using Windows 10, you will find Related Settings instead of Related link where, select ‘Advanced system settings’.
The System Properties window will appear.
Step 4: In the System Properties window, select Settings under Startup and Recovery.
Step 5: Now, under System Errors option, click on the drop-down menu of ‘Write Debug Information’ and select ‘Automatic Memory Dump.’ Finally, click OK.
This setting changes the level of granularity collected from the memory dump file when a BSOD occurs. So you can see and understand the cause of the error.
You may need to restart your PC for the changes to take effect. It’s important to remember that this will only help the BSOD to happen after you’ve changed the settings.
How to Analyze Windows Memory Dump File
There are many ways you can read memory dump files and analyze them. We will use third-party applications to open, read and analyze the mini dump files.
Note: The methods and steps involved in analyzing the memory dump files assume that your PC is in working condition and that you can install third-party tools. If you cannot access your PC, you should retrieve the dump file data and analyze it elsewhere.
1. Open and analyze .dmp files with WinDbg Preview
This is a development tool created by Microsoft to analyze and resolve errors in the system. It’s also one of the most recommended tools out there. Here’s how to use it:
Step 1: Press the Windows key on your keyboard, type Microsoft Storethen press Enter.
Step 2: In the search bar, type WinDbg Previewthen press Enter.
Step 3: Click the Get button to install WinDbg Preview.
Step 4: After installation, press Windows key on keyboard, type WinDbg Previewand click ‘Run as administrator.’
Step 5: In the WinDbg Preview Window, go to File from the top menu.
Step 6: Select Start Debugging from the left pane and select ‘Open Dump File’ in the right pane.
Step 7: Browse and locate the dump file, then click Open.
Note: You can find the latest dump file in the root directory C:\, C:\minidump or C:\Windows\minidump.
When you open the dump file, WinDbg will load it and run. Depending on the file size, WinDbg will take time to process.
Step 8: Now type below command in command tab and press Enter.
! analyze -v
This command will start parsing the dump file. This process may take a few minutes to complete. Once done, you will see the results in the Top Window. With this result, you can fix the error causing the problem.
2. How to open and analyze dump files with BlueScreenView
As the name suggests, it scans and analyzes BSOD errors. It automatically selects the Minidump folder dump file and processes it. Here’s how to install and run it.
Step 1: Download BlueScreenView using the link below, install and run it.
BlueScreenView automatically fetches dump files from your system. If not, go to Options > click Advanced options > under the ‘Load from MiniDump folder later’ box, click the Browse button > click OK.
Step 2: Click on the dump files listed in the application.
The selected memory dump file will have a list of active files and drivers. The file marked in red will have a direct link to the cause of the BSOD error. You can click and fix the problem.
BlueScreenView is only useful to find the error that caused the BSOD, unlike WinDbg it also allows you to debug the problem. You can also check out WhoCrashed that we covered a lot. It also works like BlueScreenViewer, which scans, analyzes and gets reports on dump files with one click.
Memory dump file FAQ
1. Can I delete the memory DMP file?
Yes you can. The fastest and safest way to delete dump files is to open Disk Cleanup, use the Windows Search tool > select ‘Clean up system files’ > under the files to be deleted, select ‘Memory Dump File’ system error’ > click OK.
2. Where does Windows 11 store dump files?
It’s pretty simple to locate dump files on Windows 11. Open Windows File Explorer > go to C:\Windows\Minidump.
Troubleshoot BSOD
Now you know how to open, view and analyze the dump file to fix BSOD errors. The methods and tools involved in this article are simple and effective. We hope this article helped you diagnose and resolve your BSOD problem once and for all.
Categories: How to
Source: thpttranhungdao.edu.vn/en/
