Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How can I know the type of a Windows dump file?

I have a dump file and I would like to know its "type", for example according Collecting User-Mode Dumps user mode dump has three basic DumpType: 0: Custom dump, 1: Mini dump, 2: Full dump.

According to Varieties of Kernel-Mode Dump Files kernel mode dump has five types: Complete Memory Dump, Kernel Memory Dump, Small Memory Dump, Automatic Memory Dump, Active Memory Dump.

like image 689
Alessandro Jacopson Avatar asked Oct 24 '25 22:10

Alessandro Jacopson


1 Answers

Load the DMP file in WinDbg. The type will be displayed once loaded, for example:

Loading Dump File [C:\etc\notepad.DMP]
User Mini Dump File with Full Memory: Only application data is available

While the DMP is loaded, the type can be retrieved with the || command:

0:000> ||
.  0 Full memory user mini dump: C:\etc\notepad.DMP

like image 147
dxiv Avatar answered Oct 28 '25 18:10

dxiv