How to Use a Minidump File to Fix Your Windows BSOD
By reading a minidump log file, you can find out what caused your crash.
It finally happened. Out of the blue, you’re enjoying a game, watching a movie, or just reading on the internet, when your operating system decides it doesn’t want to cooperate and suddenly you’re facing down a BSOD or Blue Screen of Death. A BSOD is something that no Windows user wants to see, because it means that your system has crashed, costing you time and perhaps even resulting in data loss.
Perhaps the worst thing about getting a Blue Screen of Death is that it could be the result of any number of issues, from a faulty piece of hardware to a driver error to having a page fault in a non-paged area (a result of a file not being found in memory). However, all isn’t lost and we’re going to show you how to enable and use a minidump log file to diagnose the problem.
Why You Need a Minidump File to Diagnose Your BSOD
In earlier versions of Windows, the BSOD showed you some error codes that were at least a little bit helpful. However, in Windows 10, the screen gives you a stop code you can write down and research and a QR code you can use with your phone. However, this only sends you to the Microsoft website and provides a description of certain error codes.
What we find useful is configuring Windows to save a file that contains lots of information regarding the BSOD and how we can go about fixing the error. This is called a minidump file.
How to Configure Windows to Save a Minidump File.
By default, the option to create a minidump file is not enabled so you’ll need to turn it on. Do this now, even if you don’t have a BSOD problem, because otherwise you won’t have a log when the crash happens.
1. Navigate to the System Properties Control Panel menu. You can get there by typing “sysdm.cpl” into the Windows search box. Or by going to Settings->System->About and clicking Advanced system settings.
2. Select the Advanced tab.
Stay On the Cutting Edge: Get the Tom's Hardware Newsletter
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
3. Enable the following options:
● Write an event to the system log
● Automatically restart
● Writing debugging information -> Small memory dump (256kb).
With this enabled, whenever Windows crashes, the minidump file will be created under “%SystemRoot%\Minidump”. You can also change this location if you choose to. However, if you do, keep in mind that most programs to troubleshoot the minidump logs are set to look for this location by default. So it’s best to leave it as it is. This also translates to C:\Windows\Minidump.
How to Read the Minidump, See What Caused Your BSOD
Now that the minidump is configured, you’ll need to download an application that can read the file and provide useful information. A tool called BlueScreenView comes recommended for doing just this.
You can download BlueScreenView by going to the official website and selecting either the 32-bit or 64-bit version of the application.
After downloading the tool, you’ll need to extract it to a location, so it can be run.
Once the tool is extracted to a directory, double click the “BlueScreenView” icon to get started. BlueScreenView will then look at the default minidump location and will look through the current logs that have been created. If you’ve experienced a number of issues or haven’t removed older minidump files, you’ll need to be mindful of the dates associated with the logs.
Using BlueScreenView to Understand Minidump Files
When you first use BlueScreenView, it will provide you with several pieces of information and at first, it may seem confusing. However, the format is straightforward and it does highlight the important information to get you started.
The files or applications that caused the crash will be highlighted in red, giving you a good idea of where to start correcting the issue.
In this screenshot (see how to take screenshots in Windows for more), we can see that on this specific minidump, there was an issue detected that affected three files; dxgmms2.sys, ntoskrnl.exe and watchdog.sys.
Further on the upper panel, we can see in the right column that there’s a section that tells us what caused the crash. In this image, we can see that the watchdog.sys caused the problem. This is a good starting point as you can now check Google or Bing, to see how this could become a problem and possible solutions.
We know that watchdog.sys is the potential cause, but what about dxgmms2.sys and ntoskrnel.exe? As those were the affected files, we need to find out what those are as well. So those will also need to be looked into. Doing a quick check on Google, we can see that dxgmms2.sys is related to the Windows DirectX drivers, while ntoskrnl.exe is the operating system kernel executable - responsible for keeping the operating system running.
Using this view of the Windows minidump file, we can deduce that the BSOD was likely caused by a graphics driver issue, which can typically be corrected by installing a newer version of the driver or reinstalling the current driver.
What If The Minidump File Shows A Hardware Error?
While driver issues are usually easily fixed, a BSOD that is a result of failed hardware is a different story. Such an example is the FAULTY_HARDWARE_CORRUPTED_PAGE error. Here, you would still use an application such as BlueSceenWindow to find the cause of the error. However, when a hardware error occurs, there’s not a magical fix that will correct this. For this specific error, we’re going to say that the result of this error was due to an installed memory module.
To figure out if this is the actual cause, we’d have to test the memory. There are several ways to do this; using a hardware memory checker or an application. Seeing how most people don’t have access to a physical memory checker, we’ll opt for the application route. Thankfully, Microsoft has included a memory diagnostics tool that has been included dating back to Windows 7. To use this, open up a run prompt and type “mdsched”.
You’ll have two options to choose from; Restart Now or Check for problems the next time you start my computer. If you choose the first option, be sure to save your work as Windows will close out.
Once your computer restarts, the memory checker will load and start checking your memory. Depending on how much memory you have installed, the process can take a while. While the test is running, you’ll see a progress bar and an overall status. Any errors that may be encountered will be displayed under the status section.
Once the test is completed, the memory test will boot into Windows. If there are no errors, you can conclude that your memory is not at fault.
Keith Mitchell is a Contributing Writer for Tom's Hardware US. He is an IT professional during the day, and a passionate lover of video games and tech after his 9-5 grind. He has a weird affinity for Soulsborne games and plays them non-stop.
-
Colif Bluescreenview???? really??Reply
Come on. It almost always blames ntoskrnl and its the victim, not the cause - Its the windows kernel.
DirectX is one of the more obvious results. Same as if error mentions dwm.sys
At least you showed them how to create Minidump files so I won't be too angry :)
You should have told them to ask on forums, if they still need help, as some of us have a little experience answering those things. -
gardenman I've read the article and while I agree with most of it, there's a few things that I would note.Reply
BSODs are caused by 3rd party drivers or bad hardware. It's an extremely rare occasion (if ever) when it's actually caused by a Microsoft driver.
BlueScreenView can be useful in the scenario described in the article. But, it usually only provides general information and rarely points directly to a driver. I would also recommend to download the Windows Debugger (WinDbg Preview) from the Window Store. But even then, it's a rare occasion when it shows the actual driver that is causing the issue. And if the issue is hardware, expect even more confusing results. A bad RAM module will often point at multiple different drivers in the dump files when none are really to blame. However, both applications can be used to help aim you in a direction of figuring out what the actual cause is.
The Windows Memory Diagnostic is known to be a weak memory tester. In fact a test may only last 20 or so minutes for 12GB of RAM. It's not completely useless. If it shows an error, that tells you to find other ways to test the RAM. It's much better to use memtest86 from the start, and test 1 RAM module at a time. These tests will last hours (4 passes should be the minimum testing length).
Overall I give the article a thumbs up. Better testing tools should be listed. Also, if the issue is hardware other than RAM, it could have listed a few of the tools used to test other hardware such as Prime95 for CPU testing, or hard drive testing software such as Hard Disk Sentinel, etc. Overall, don't expect the dumps to tell you the exact problem because they rarely do. -
drea.drechsler About Memory Diagnostic....Reply
When it reboots into Windows it does so without so much as a fair-thee-well. So other than sitting throughout the entire test, how do you determine if there were....or were not...any errors? It can take a VERY long time sitting there watching the screen to see if it reports an error, especially if you run it through multiple cycles for confidence using all the tests.
Are there any suggestions to help find errors...or a successful test report... easier? The only way I know is to search through the Windows Event Log which can be pretty frustrating in it's own right.
And also, I've always considered BSOD diagnosing something of value mainly for developers, especially device driver developers. Us average users, even if having a diagnoses of the BSOD, will probably only be able to fix it by 1)removing any overclocks 2)uninstalling whatever was most recently installed or updated or 3)reset windows. Running 'SFC/scannow' can help...sometimes. But fixes that entail digging into the internals of Windows, including registry edits, are frequently beyond us anyway. -
Bulldog17 Admin said:Find out how to enable and read the Windows 10 minidump file so you can see exactly why your computer is crashing.
How to Use a Minidump File to Fix Your Windows BSOD : Read more
I disagree with the recommendation to 'Automatically restart.' In many cases, this results in the computer restarting over and over, with no way to stop the restarts. -
waltc3 I haven't had a GSOD (Win10--Win7 is BSOD. IIRC) in so long I cannot remember exactly when. I do recall that the last one I had was caused by an overclocking experiment I was running. That was years ago. If your device drivers are up to snuff then you probably won't see a GSOD these days unless you are overclocking--at least, that has been my experience. (And I run beta builds of Win10, exclusively.)Reply -
Colif
its in your favourite place, event viewerdrea.drechsler said:When it reboots into Windows it does so without so much as a fair-thee-well. So other than sitting throughout the entire test, how do you determine if there were....or were not...any errors? It can take a VERY long time sitting there watching the screen to see if it reports an error, especially if you run it through multiple cycles for confidence using all the tests.
open event viewer
expand the windows logs folder
right click system and click findtype MemoryDiagnostics-Results and click find button
On Event Viewer, double-click the MemoryDiagnostics-Results source, and see the message. If the result reads "The Windows Memory Diagnostic tested the computer's memory and detected no errors," then you can discard memory as the root of the problem.
https://www.windowscentral.com/how-check-your-pc-memory-problems-windows-10
Personally I would just run memtest86
1 makes sense, 2 if you did actually update something recently... I try to find other means before I hit 3.drea.drechsler said:And also, I've always considered BSOD diagnosing something of value mainly for developers, especially device driver developers. Us average users, even if having a diagnoses of the BSOD, will probably only be able to fix it by 1)removing any overclocks 2)uninstalling whatever was most recently installed or updated or 3)reset windows. Running 'SFC/scannow' can help...sometimes. But fixes that entail digging into the internals of Windows, including registry edits, are frequently beyond us anyway.
SFC only helps if its a windows process that actually caused the BSOD (Critical Process Died is one such Windows only bsod)
I never look in the registry, I find 99% of problems can be fixed without ever looking in regedit. Many can be caused by going in there.
I have spent last 5 years trying to help people with BSOD here, I am pretty good but I know there is more I just don't understand. There are over 300 BSOD codes but I see a small number of those here, but causes aren't as easily counted. -
drea.drechsler Colif said:....
open event viewer
expand the windows logs folder
right click system and click findtype MemoryDiagnostics-Results and click find button
.....
https://www.windowscentral.com/how-check-your-pc-memory-problems-windows-10
Personally I would just run memtest86
.....
Thanks! that's a good trick to finding specific entries in the event log I'll have to remember.
I've had more luck with HCI MemTest than MemTest86. It will find edge-case memory instability pretty quickly even though hours of MemTest86 using all the possible tests, 2 or 3 times through, missed.
I can appreciate the urge to 'find the problem' rather than just throw it all out. That can be important for developers and people with highly off-standard configurations who have to know what their own efforts have messed up since it will quite likely be repeated an any fresh install. But for an average user, running the device drivers of bog-standard hardware, all that really matters is the bottom line: restore reliable functionality in least amount of time.
I also use 'System Restore' to roll back to earlier Restore Points. Except I think Microsoft is deprecating it as it's become harder to find (just typing in System Restore takes you to the Recovery applet) and you have to set it up. And be sure it's run to create a restore point when installing things, especially when installing device drivers. But the times I've used it it's worked a trick. -
Colif I think a fair percentage of the people who come here asking for help on BSOD, they appreciate we don't just tell them to reset or full install, not without checking what cause might be. Full install is the hammer approach, its useful if the BSOD still occur after as you know its hardware, but for many driver errors, its a step too far.Reply
Most people don't have backups or multiple hdd in PC, some of you may but I am not exactly talking about us. So the idea of a reset or clean install, starting afresh is not normally on their menu. They prefer to try anything else.**
There is a way to force windows to show what driver is causing it problems but it is almost as dangerous as the bsod its supposedly fixing. Driver Verifer, part of Windows but can cause boot loops. I only suggest it if the process of identifying actual cause takes too long.
I prefer to know what cause is rather than reset and hope it doesn't repeat.
I used to use system restore, we talking Vista days... it wasn't much good for what i used it for but that could have been me more than it. It was my final choice if other ways to fix things had failed, I would often just end up clean installing. Eventually skipped it altogether and went to clean install. It might have been ME I first used it, and well, ME was special and could have tainted my ideas.
System restore useful for rolling back recently installed drivers or Windows updates (although it won't work for version updates as they overwrite the folder)
** if pc won't boot then there are times a reinstall is only choice but there are ways to save any data off drive before reinstall. -
drea.drechsler
That's the situation I find it useful...and probably the only one. Going back more than two restore points, or three at the outside, does not often result in a happy repair. It's usually a botched display driver update too, when even a DDU doesn't make it right.Colif said:....
System restore useful for rolling back recently installed drivers or Windows updates (although it won't work for version updates as they overwrite the folder)
.... -
Colif it saves a copy of the registry + all drivers installed so yeah, go too far back and you can break all sorts of things. Normally anti virus is one of them.Reply