Memory Dump

Microsoft Windows is vulnerable to system freezes, unexpected shutdowns, and various “Stop” errors. When these errors occur, Windows writes debugging information into a memory dump file. Three different formats of memory dumps exist: complete memory dump, kernel memory dump, and small memory dump.

The complete memory dump records all system memory contents into a file. In order for this option to be implemented, you must have a paging file on your boot volume that is large enough to hold your physical RAM plus one additional megabyte. Keep in mind that complete memory dumps are not available to systems with over two gigabytes of memory or on systems running a 32-bit operating system.

Kernel memory dumps record only the kernel memory which speeds up the logging process and takes a smaller piece of hard drive space. Your boot volume should have between 50 to 800 free megabytes for the paging file or 1/3 of the amount of physical memory you have onboard. This option records kernel-related memory.

The small memory dump records a small set of memory information that is sometimes useful in troubleshooting why your computer stopped responding. This option takes just two megabytes of free space. While the other two memory dumps are always being overwritten with each new Stop error, the small memory dump creates a new file with each error (in Windows 2000 and above) and stores a complete history in a folder.

To set the various dump settings on your computer, go into the Start button, choose Control Panel, double-click the System icon, and find the Advanced tab. In Windows Vista, the Control Panel shows links rather than tabs, click on the Advanced System Settings link instead. Next, click on Startup and Recovery. Here you can specify the type of dump file you want your system to create or change the default location of the memory dump.

After a Stop error, you can use the dumpchk.exe utility to check your memory dump file. By default, this utility is not installed on your operating system. Use the original installation disks to install it. The Dump Check Utility is located in the Support Tools section. Go to the Support Tools folder and run Setup.exe. This will install dumpchk.exe to the Program Files\Support Tools folder on your hard drive. Dumpchk.exe will allow you to view the contents of the logged errors.

You can also download Debugging Tools directly from Microsoft here: http://www.microsoft.com/whdc/devtools/debugging/default.mspx

Using memory dump files is simple however analyzing them requires a bit of technical expertise.You’ll need to know the following options:

DUMPCHK [options] <CrashDumpFile>

     -?    This will display the command syntax

     -p    This will print only the header without any validation

     -v    This will specify the verbose mode

     -q    This will perform a quick test however it’s not available in Windows XP
                                               
The Windows XP version of dumpchk.exe has additional options:    
    -c     This adds dump validation

    -x     This adds extra file validation but it takes longer

    -e     This performs a dump exam

    -y <Path>    This sets the symbol search path for the dump exam. If empty, the CD-ROM
       is searched for symbols

    -b <Path>    this options sets the image search path for the dump exam. If the path is empty, the  %SystemRoot%\System32 folder is searched.

    -k <File>     This sets the name of the kernel to File

    -h <File>     this sets the name of the HAL to File