How can I know the type of a Windows dump file?

1.4k views Asked by At

I have a dump file and I would like to know its "type", for example according Collecting User-Mode Dumps user mode dump has three basic DumpType: 0: Custom dump, 1: Mini dump, 2: Full dump.

According to Varieties of Kernel-Mode Dump Files kernel mode dump has five types: Complete Memory Dump, Kernel Memory Dump, Small Memory Dump, Automatic Memory Dump, Active Memory Dump.

1

There are 1 answers

3
dxiv On BEST ANSWER

Load the DMP file in WinDbg. The type will be displayed once loaded, for example:

Loading Dump File [C:\etc\notepad.DMP]
User Mini Dump File with Full Memory: Only application data is available

While the DMP is loaded, the type can be retrieved with the || command:

0:000> ||
.  0 Full memory user mini dump: C:\etc\notepad.DMP