Principles of WinDBG functioning

Gadgety · 26 Nov 2016

On the forum I find instructions of how to install and test WinDBG, but I have a hard time finding descriptions of how it works in principle.

Here are my questions:

1. Are dumpfiles overwritten? That is, does dmp work as a buffer, so when new dmp files are created by the system, the old ones are overwritten? I read somewhere the dmp file can get pretty large, in that case dmp files would be saved until explicitly deleted. I'm asking because when doing the BugCheckAnalysis of the dmp only the latest BSOD is part of the readout. They can still be found in the Log Book for administrative occurences (sorry if this Log Book is the incorrect term, Windows mixes English with local language)

2. Are dumpfiles temporary and once read and analysed, are they gone? I can't regenerate the report.

ICIT2LOL · 26 Nov 2016

Hello mate look as far as I know the dump files should be in a list form and I am wondering if you have cleared any dump files by using a disk clean up something like this Disk Cleanup - Open and Use the first option in C: Properties - right click on the C: drive > Properties > General tab > Disk Cleanup will list clear dump files for example there is a second option that will clear old updates etc too

Edit Imeant to add that the dumps should remain after reading them not deleted so try this Dump Files - Configure Windows to Create on BSOD

Gadgety · 27 Nov 2016

Thank you ICIT2LOL. No I haven't done any dump file clearing or disk clean up. Thank you for the link.

**axe0** · 27 Nov 2016

Hi Gadgety,

- The MEMORY.dmp (located in %systemroot%) is the dump that gets overwritten by default, because it contains all kernel data the RAM had at the time of the crash, depending on the amount of memory the size could get up to gigabytes.
If you uncheck the overwrite option, Windows will not delete this file and insteads creates a new file, the downside of this is that it takes a lot of space on the disk.

- The minidumps (located in %systemroot%\minidump) are the dumps that do not get overwritten. However some do get deleted when there are about 50 dumps in this location present (if I'm correct). These dumps we mostly use.

Dump files are not temporary files, dumps are present on the disk so long as they are not deleted by utilities like disk cleanup or Ccleaner.