What is a MiniDump File?
When you encounter a BSOD (Blue
Screen of Death) in Windows the computer will save information
regarding the error message in a log file. This log file or minidump
file is saved in the Minidump subdirectory under Windows
(C:\Windows\MiniDump). Generally the information saved in this minidump
file can help pinpoint the cause of the blue screen error message and
help you in resolving the problem.
However, the minidump file is
not saved in a text format, so if you try to open the file in a text
editor like Notepad you won't be able to decipher the information and
understand it.
So, how do you view a minidump file and decipher
the contents? Microsoft distributes several utilities that allow you to
do this, but you have to download them. The following information will
help you configure your system to save minidump files, download and
install the debugging tools, and view the minidump files.
Configuring Windows to Save MiniDump Files
First of all,
you need to configure Windows to save these important log files. Most
of the time, this is already done automatically, however follow these
steps to make sure these log files are being saved.
1) Click on Start
2) Right-click on My Computer
3) Click on Properties
4)
In Windows XP, click on the Advanced tab. In Windows Vista, click on
the Advanced System Systems option on the left side of the screen.
5) Under Startup and Recovery, Click on the Setting button
6)
Under the System Failure section, you'll see the options for the memory
dump file. Write an event to the system log should be checked along
with Send an Administrative Alert. The debugging information should be
set to the Small Memory dump (64K) and generally the Small Dump
Directory is set to %SystemRoot%\Minidump. In most cases this is the
C:\Windows\Minidump directory.
As far as the third check box is
concerned, if this is checked the computer will automatically restart
when a blue screen error message is encountered. So, if your computer
is booting into Windows, then rebooting automatically most likely you
are getting some sort of blue screen error message and its forcing the
computer to restart. If you uncheck this box, then the message itself
will appear so you can retrieve important details about the error.
Download and Installing the Debugging Tools to Read Minidump Files
In order to view the Minidump files, you have to download the following tools.
Debugging Tools for Windows including WinDbgAlthough
most of the time its not necessary, you can download the Symbol
packages as well as the Debugging Tools so you can read the Minidump
logs easier. Once you've downloaded the Debugging Tools for the correct
version of Windows and installed them, open the WinDbg program by
following these steps.
1) Click on Start
2) Click on All Programs
3) Click on Debugging Tools for Windows group
4) Click on WinDbg to open
The screen should look similar to the one below.
Deciphering the Minidump Files
In the WinDbg program, click on File, then click on Open Crash Dump
Browse
to the following directory on your hard drive and open a minidump log.
The drive letter will be whichever drive you installed Windows on. In
most cases, this is drive C.
C:\Windows\Minidump
After
you open a minidump file in WinDbg, scroll to the bottom of the file.
You should see a line that says Probably caused by:, followed by a
filename. This is the problem file. In my case the file was related to
the ELock Program in the Acer Empowering Technology set of tools. I
simply uninstalled this program from the computer and the blue screen
and problem went away.
Probably caused by : eLock2FSCTLDriver.sys ( eLock2FSCTLDriver+11332 )
Although
you may not recognize the file that is causing the problem, it
definitely helps in tracking down a solution for the blue screen error
message and resolving the issues.
WhoCrashed - A Program that Automatically Analyzes MiniDump files
If
you want a simplier option, download the program WhoCrashed, and
install it. It will automatically find, analyze, and decipher the
minidump files and point you to the offending driver or device that is
causing the blue screen of death.
Download WhoCrashed Now