Search code examples
windowsdumppostmortem-debugging

How can I know the type of a Windows dump file?

I have a dump file and I would like to know its "type", for example according Collecting User-Mode Dumps user mode dump has three basic DumpType: 0: Custom dump, 1: Mini dump, 2: Full dump.

According to Varieties of Kernel-Mode Dump Files kernel mode dump has five types: Complete Memory Dump, Kernel Memory Dump, Small Memory Dump, Automatic Memory Dump, Active Memory Dump.

Solution

  • Load the DMP file in WinDbg. The type will be displayed once loaded, for example:

    Loading Dump File [C:\etc\notepad.DMP]
User Mini Dump File with Full Memory: Only application data is available

    While the DMP is loaded, the type can be retrieved with the || command:

    0:000> ||
.  0 Full memory user mini dump: C:\etc\notepad.DMP