This article teaches you how to analyze your Windows computer’s dump files after a crash. Dump files, which are automatically created by Windows after your computer crashes, display a list of programs that were running before the crash; this can help you determine which programs are responsible for the crash. If you’re anticipating another crash or you want to test a program, you can use a free program called BlueScreenView to analyze your dump files. You can also use the free Windows 10 Drivers Kit to open dump files from a past crash.

Part 1

Reading with BlueScreenView

  1. Image titled Read Dump Files Step 1
    1- Open Start 
    Image titled Windowsstart.png

    . Click the Windows logo in the bottom-left corner of the screen.

  2. Image titled Read Dump Files Step 2
    2- Type in view advanced system settings. This will search your computer for the Advanced System Settings section of Control Panel.
  3. Image titled Read Dump Files Step 3
    3- Click View advanced system settings. It’s a computer monitor with a checkmark icon at the top of the Start menu. Doing so opens the Advanced System Settings window.
  4. Image titled Read Dump Files Step 4
    4- Click the Advanced tab. You’ll see this at the top of the window.
    • You may first have to click the computer monitor-shaped icon that appears at the bottom of the screen to open the Advanced System Settings window.
  5. Image titled Read Dump Files Step 5
    5- Click Settings. It’s below the “Startup and Recovery” heading near the bottom of the page. Doing this will open a separate window.
  6. Image titled Read Dump Files Step 6
    6- Click the “Write debugging information” drop-down box. You’ll find this box in the middle of the separate window. Clicking it prompts a drop-down menu.
  7. Image titled Read Dump Files Step 7
    7- Click Small memory dump. It’s in the drop-down menu. This option makes future memory dumps readable with a simple file explorer such as BlueScreenView.
  8. Image titled Read Dump Files Step 8
    8- Click OK. It’s at the bottom of the window. This will close the window and return you to the Advanced System Settings window.
  9. Image titled Read Dump Files Step 9
    9- Click OK. Doing so saves your changes and closes the Advanced System Settings window.
  10. Image titled Read Dump Files Step 10
    10- Open the BlueScreenView page. Go to https://www.nirsoft.net/utils/blue_screen_view.html in your browser. BlueScreenView is a program that finds and analyzes dump files for you, making it easy to see which programs were running directly before a crash.
  11. Image titled Read Dump Files Step 11
    11- Download BlueScreenView. Scroll down and click the Download BlueScreenView with full install/uninstall support link that’s near the middle of the page.
  12. Image titled Read Dump Files Step 12
    12- Open the BlueScreenView setup file. Double-click the bluescreenview_setupfile in your computer’s “Downloads” location.
  13. Image titled Read Dump Files Step 13
    13- Install BlueScreenView. To do so:
    • Click Yes when prompted.
    • Click Next
    • Click Next
    • Click Install
    • Wait for BlueScreenView to install.
  14. Image titled Read Dump Files Step 14
    14- Open BlueScreenView. Make sure that the “Run NirSoft BlueScreenView” box is checked, then click Finish at the bottom of the window. BlueScreenView will open.
  15. Image titled Read Dump Files Step 15
    15- Review your dump files. BlueScreenView has a top pane and a bottom pane; you’ll see the dump file(s) listed in the top pane, while the programs that were recorded by the currently selected dump file will appear in the bottom pane.
    • You can select a dump file by clicking it in the top pane.
    • At least one of the programs that were recorded by the dump file is most likely responsible for the crash.

Part2

Reading with the Windows Drivers Kit

  1. Image titled Read Dump Files Step 16
    1- Open the Windows 10 Drivers Kit page. Go to https://docs.microsoft.com/en-us/windows-hardware/drivers/download-the-wdk in your browser. The Windows Drivers Kit allows you to open dump files of all kinds, making it useful for checking a dump file from a past crash.
  2. Image titled Read Dump Files Step 17
    2- Download the Windows Drivers Kit setup file. Scroll down and click the Download WDK for Windows 10, version 1803 link, which is below the “Install WDK for Windows 10” heading near the top of the page. The setup file will download onto your computer.
  3. Image titled Read Dump Files Step 18
    3- Open the WDK setup file. Double-click the wdksetup file in your computer’s default “Downloads” folder.
  4. Image titled Read Dump Files Step 19
    4- Install the Windows 10 Drivers Kit. To do so:
    • Click Next on the first 4 pages.
    • Click Accept
    • Click Yes when prompted.
    • Wait for the WDK program to finish installing.
  5. Image titled Read Dump Files Step 20
    5- Open Start 
    Image titled Windowsstart.png

    . Click the Windows logo in the bottom-left corner of the screen.

  6. Image titled Read Dump Files Step 21
    6- Type in command prompt. This will search your computer for the Command Prompt app.
  7. Image titled Read Dump Files Step 22
    7- Right-click 
    Image titled Windowscmd1.png

    Command Prompt. It’s a black box at the top of the Start window. A drop-down menu will appear.

  8. Image titled Read Dump Files Step 23
    8- Click Run as administrator. This option is in the drop-down menu.
    • You won’t be able to complete this step if you’re not on an administrator account on your computer.
  9. Image titled Read Dump Files Step 24
    9- Click Yes when prompted. Doing so opens the Command Prompt app in administrator mode.
  10. Image titled Read Dump Files Step 25
    10- Switch to the WDK directory. Type in the following address and then press  Enter:
    • cd C:\Program Files (x86)\Windows Kits\10\Debuggers\x86
  11. Image titled Read Dump Files Step 26
    11- Enter the installation command. Type in windbg.exe -IA and then press  Enter.
  12. Image titled Read Dump Files Step 27
    12- Click OK when prompted. This signifies that the Windows Debugger will now open dump files automatically.
  13. Image titled Read Dump Files Step 28
    13- Open WinDBG. Click Start
    Image titled Windowsstart.png

    , type in windbg, and click WinDbg (X86) in the results. The Windows Debugger program will open.

  14. Image titled Read Dump Files Step 29
    14- Add a symbol path. The symbol path tells the Windows Debugger which information to display:[1]
    • Click File in the upper-left corner.
    • Click Symbol File Path…
    • Type in SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
    • Click OK
  15. Image titled Read Dump Files Step 30
    15- Find your dump file. To do this, you’ll need to go to the system root folder:
    • Open Start
    • Type in run and press  Enter
    • Type in %SystemRoot%
    • Click OK
    • Click the View tab.
    • Check the “Hidden items” box if it isn’t already checked.
    • Scroll down and double-click the MEMORY.DMP file.
  16. Image titled Read Dump Files Step 31
    16- Review the dump file’s results. You should see a list of programs that were open when your computer crashed, which will help you determine which program(s) is/are responsible for the computer crash.