Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: BSOD Analysis - Getting Started

27 Mar 2012   #1

Windows 7 Professional x64
 
 
BSOD Analysis - Getting Started

So, you're interested in learning to solve BSODs? A satisfying goal, and there's good job security as there's an endless supply of threads.

To be a good BSOD analyst, you don't need deep technical knowledge of how Windows works (though it doesn't hurt!). You do need a good "technician's knowledge" of computers, as there's so much more to it than "what driver was blamed?". As often as not, hardware is the cause, and you should be proficient in that regard. Instructing OPs how to swap out RAM, change memory voltages, and spot PSU problems is SO much easier when you are familiar with the processes already.

Good surface knowledge of Windows is essential. What if that driver won't install right? What if Windows won't boot right? What if you suspect malware is the cause...do you know how to spot other signs of it? What if the OP wants to do a repair install but his DVD is giving him an error message? You could just farm stuff out, but it's better if you're capable of handling it all yourself.

Perhaps even more important is a desire to get to the bottom of the case, no matter what it is. Good BSOD analysts don't feel the need to stick to the "rules" of the game. They exercise complete liberty to post whatever they want in the thread, no matter how unorthodox it might be. Feel like turning the OP into a guinea pig? Go for it! Try new things, learn what doesn't work, and remember what did work for next time. And when you see a thread someone else has solved, spend the 30 seconds and find out what symptoms the the OP was having, and what the solution was.


Ready to proceed?

Start by installing Windbg from the Windows SDK: http://msdn.microsoft.com/en-us/wind...dware/hh852360

Once installed, associate .dmp files with Windbg by entering the following in a command prompt:
Code:
"C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\windbg.exe" -IA
If Windbg is installed in a different location, change the command accordingly. Just a heads-up, the -IA part is case sensitive. Confused the heck out of me when I first tried it, as most commands are not case sensitive.

When done, open a copy of Windbg, go to File > Symbol file path, and copy/paste:
Code:
SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
You can replace C:\symbols with any other path you'd like the symbol cache to be stored on. If you have a low-capacity SSD, be warned the folder can grow to a couple GBs.

After that, you can just double-click on the dmps and it will open. If a driver or program is the cause of the BSODs, it will usually show up in the Probably Caused By line.
Code:
Probably caused by: e1c62x64.sys
You can look up the drivers it blames here: Driver Reference Table

A couple other tips:

If a Windows/system driver is blamed, it's not the real problem. Use your powers of reasoning: if tcpip.sys is blamed, perhaps the network adapter drivers are at fault?

You can use Driver Verifier to try to get 3rd-party drivers blamed: Driver Verifier - Enable and Disable

If Verifier_Enabled dumps continue to point to system drivers, hardware is most likely the cause. The most common cause is RAM, though CPU, motherboard, PSU, video card, hard drive, and sometimes some funky ones (monitor, USB devices) can also cause problems. I wrote up some tutorials to diagnostics we use often:

RAM - Test with Memtest86+

Hardware - Stress Test With Prime95

To get a list of the running drivers on the system at the time of the crash, run from Windbg:
Code:
lmntsm
Spend some time looking up those drivers on the Driver Reference Table until you can quickly glance down the list and pick out the 3rd-party ones. The Windows drivers are rarely of any consequence, but you should still know what they do. One word of warning, however: don't fall into the same pitfall all too many people do, and that is putting too much emphasis on the date of the driver. Is it true that older drivers can have compatibility problems, and should be updated, but few things that I see BSOD analysts doing irritate me more than lists of drivers to update. If a 3rd-party driver is the cause, 95% of the time it will be blamed directly.

I'd be a fool not to at least mention the !analyze -v command. Try running that on a dump, see what kind of information it reveals. PROCESS_NAME shows which process was running at the time of the crash; usually not enough to make any conclusions, but when taken from many dumps from the same system, may reveal some circumstantial evidence. FAILURE_BUCKET_ID and BUCKET ID can sometimes reveal culprit drivers that are not blamed in the Probably Caused By line.

And one last command I rarely see any other BSOD analysts on the volunteer forums using: the !sysinfo commands. !sysinfo machineid shows information about the motherboard and OEM. !sysinfo smbios reveals a wealth of information about the motherboard configuration. Want to know what size DIMMs are installed in which slots, and what speed they're running at? Give it a whirl! Or run the generic !sysinfo command for a list of supported arguments and try them out.


Get to know what information you have access to. Once you do, you will no longer be content to simply use the dumps. I resigned from a Moderator position and left another forum once, among other reasons, but a major part was they didn't see the point in asking for the other info, and weren't on board with my attempts to get some instructions stickied.


That's the basic idea of what we do. As you go along, you'll have dozens (if not more!) of questions. Feel free to post questions in this thread, or you can PM me and I'll help you along.

Good luck!



Attached Thumbnails
BSOD Analysis - Getting Started-capture.jpg  
My System SpecsSystem Spec
.

29 Mar 2012   #2

Microsoft Community Contributor Award Recipient

Windows 7 Ult x64 - SP1/ Windows 8 Pro x64
 
 

Excellent post Jon, could be a tutorial with a couple more pictures

Well done.
My System SpecsSystem Spec
02 Apr 2012   #3

windows 7 home premium 64
 
 

I am lost! The above link for sdk goes to Windows 8 beta stuff. Nowhere can I see anything like windbg. Am a newbie to Windows 7, having just begun to use it after frustration with old PC and XP. Can you make it a bit clearer please? I am having frequent BSOD messages and have managed to get the jcgriff2 extract so far.
My System SpecsSystem Spec
.


02 Apr 2012   #4

Windows 7 Professional x64
 
 

Hi Bob,

I've updated the link; is there anything else you'd like clarified? I have posted in your thread, btw.
My System SpecsSystem Spec
10 Apr 2012   #5

Microsoft Community Contributor Award Recipient

Windows 7 64-bit
 
 

Quote   Quote: Originally Posted by Bob Pickering View Post
I am lost! The above link for sdk goes to Windows 8 beta stuff. Nowhere can I see anything like windbg. Am a newbie to Windows 7, having just begun to use it after frustration with old PC and XP. Can you make it a bit clearer please? I am having frequent BSOD messages and have managed to get the jcgriff2 extract so far.
You can install the Windows 8 SDK/WDK regardless of which Windows OS you are using. The Debugging Tools for Windows will work on Windows Vista and 7 (even XP too I think). It is just preferred because it uses the newest version of the Debugging Tools (Windbg), whereas installing the Windows 7 SDK/WDK will result in installing an older Windbg.
My System SpecsSystem Spec
03 Jun 2012   #6

Microsoft Community Contributor Award Recipient

Windows 7 Ult x64 - SP1/ Windows 8 Pro x64
 
 

Had some trouble installing the Debugger on Win8 RP.
Finally got it working.
My System SpecsSystem Spec
15 Jul 2012   #7

Desk1 8 Pro / Desk2 7 Home Prem / Laptop 8.1 Pro all 64bit
 
 

Hey Jonathan that was an interesting read I am really impressed - I just wish I had more of a knowledge re Windows surface stuff as I only compute and fix for a pastime / hobby pending my imminent retirement.

John
My System SpecsSystem Spec
18 Jul 2012   #8

Microsoft Windows 7 Home Premium 64-bit Service Pack 1
 
 

I'm confused. Which one of these file packages do I get?
My System SpecsSystem Spec
18 Jul 2012   #9

Microsoft Windows 7 Pro 64-bit SP1
 
 

Quote   Quote: Originally Posted by HoneycombAG View Post
I'm confused. Which one of these file packages do I get?
Chose the Windows SDK.


Also, I am trying to learn BSODs, and made my first attempt of reading one and made a post. I am hoping someone will correct me and tell me what i assumed wrong or read wrong.
My System SpecsSystem Spec
18 Jul 2012   #10

Microsoft Community Contributor Award Recipient

Windows 7 64-bit
 
 

Honor, what is the post you're referring too? Thanks.
My System SpecsSystem Spec
Reply

 BSOD Analysis - Getting Started




Thread Tools



Similar help and support threads for2: BSOD Analysis - Getting Started
Thread Forum
BSOD and Others analysis BSOD Help and Support
BSOD Analysis BSOD Help and Support
BSOD analysis? BSOD Help and Support
Please can any one help BSOD analysis BSOD Help and Support
Please help with BSOD analysis BSOD Help and Support

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 08:45 AM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33