Windows can create several different types of memory dumps. You can
access this setting by opening the Control Panel, clicking System and
Security, and clicking System. Click Advanced system settings in the
sidebar, click the Advanced tab, and click Settings under Startup and
recovery.
By default, the setting under Write debugging information is set to
“Automatic memory dump.” Here’s what each type of memory dump actually
is:
Complete memory dump: A complete memory dump is the
largest type of possible memory dump. This contains a copy of all the
data used by Windows in physical memory. So, if you have 16 GB of RAM
and Windows is using 8 GB of it at the time of the system crash, the
memory dump will be 8 GB in size. Crashes are usually caused by code
running in kernel-mode, so the complete information including each
program’s memory is rarely useful — a kernel memory dump will usually be
sufficient even for a developer.
Kernel memory dump: A kernel memory dump will be
much smaller than a complete memory dump. Microsoft says it will
typically be about one-third the size of the physical memory installed
on the system.
Small memory dump (256 kb): A small memory dump is the
smallest type of memory dump. It contains very little information — the
blue-screen information, a list of loaded drivers, process information,
and a bit of kernel information. It can be helpful for identifying the
error, but offers less detailed debugging information than a kernel
memory dump.
Automatic memory dump: This is the default option, and it contains the exact same information as a kernel memory dump.
Microsoft says that, when
the page file
is set to a system-managed size and the computer is configured for
automatic memory dumps, “Windows sets the size of the paging file large
enough to ensure that a kernel memory dump can be captured most of the
time.” As Microsoft points out, crash dumps are an important
consideration when
deciding what size the page file should be. The page file must be large enough to contain the memory data.
(none): Windows won’t create memory dumps when it crashes.
Memory Dumps Are For Developers
These dump files exist to provide you with information about the
cause of the system crash. If you’re a Windows developer working on
hardware drivers, the information in these memory dump files could help
you identify the reason your hardware drivers are causing a computer to
blue-screen and fix the problem.
But you’re probably just a normal Windows user, not someone
developing hardware drivers or working on the Windows source code at
Microsoft. Crash dumps are still useful. You might not need them
yourself, but you may need to send them to a developer if you’re
experiencing a problem with low-level software or hardware drivers on
your computer. For example,
Symantec’s website says that
“Many times Symantec Development will need a Full Memory Dump from an
affected system to identify the cause of the crash.” The crash dump may
also be useful if you’re experiencing a problem with Windows itself, as
you may need to send it to Microsoft. The developers in charge of the
software can use the memory dump to see exactly what was going on on
your computer at the time of the crash, hopefully allowing them to pin
down and fix the problem.
Minidumps vs. Memory Dumps
Minidump files are useful to pretty much everyone because they
contain basic information like the error message associated with a
blue-screen of death. They’re stored in the C:\Windows\Minidump folder
by default. Both types of dump files have the file extension .dmp.
Even when your system is configured to create an kernel, complete, or
automatic memory dump, you’ll get both a minidump and a larger
MEMORY.DMP file.
Tools like
Nirsoft’s BlueScreenView
can display the information contained in these minidmp files. You can
see the exact driver files involved in a crash, which can help identify
the cause of the problem. Because minidumps are so useful and small, we
recommend never setting the memory dump setting to “(none)” — be sure to
at least configure your system to create small memory dumps. They won’t
use much space and will help you if you ever run into a problem. Even
if you don’t know how to get information out of the minidump file
yourself, you can find software tools and people who can use the
information here to help pin down and fix your system problem.
Larger memory dumps like kernel memory dumps and complete memory
dumps are stored at C:\Windows\MEMORY.DMP by default. Windows is
configured to overwrite this file each time a new memory dump it
created, so you should only have one MEMORY.DMP file taking up space.
While even average Windows users can use minidumps to understand the
cause of blue-screens, the MEMORY.DMP file is used more rarely and isn’t
useful unless you plan on sending it to a developer. You probably won’t
need to use the debugging information in a MEMORY.DMP file to identify
and fix a problem on your own.