Windows memory dump files (Memory.dmp and Minidump)
Crash dump files that hold part of the memory state at a system crash, written to Memory.dmp or the Minidump folder.
01Location
%SystemRoot%\Memory.dmp (DumpFile value under CrashControl)
%SystemRoot%\Minidump (MinidumpDir value under CrashControl)
02Questions it answers
Did the system write a crash dump, and which type of dump was configured?
How much memory can the dump file hold: a complete dump, or a 64 KB small dump?
Could a later dump have overwritten an earlier one?
03Format and versions
Format
Five kernel-mode dump settings are documented: complete memory dump, kernel memory dump, small memory dump (64 KB), automatic memory dump and active memory dump.
Applies to
Windows systems. The dump type and file paths are set in CrashControl registry values; check them on the system in hand.
04Key fields
Field
What it tells you
DumpFile
CrashControl value that names the memory dump file; the source lists %SystemRoot%\Memory.dmp.
MinidumpDir
CrashControl value for the folder that keeps the list of small memory dump files (%SystemRoot%\Minidump).
CrashDumpEnabled
Registry value; the source maps 0x7 to automatic memory dump.
05Examination workflow
Read the CrashControl values and the file lists of %SystemRoot% and Minidump before any file is opened or copied.
Hash each dump file and record its size and time stamps; keep the original unchanged.
Compare the dump type with the file size to judge how much memory the file can hold; a 64 KB small dump holds a very limited part.
06Interpretation pitfalls
A small memory dump is 64 KB; it cannot represent the whole memory state of the system.
A complete memory dump is the largest type and includes some user-mode memory; the source does not say how much of memory it covers.
Automatic memory dump appears as a registry value (0x7), but the source does not describe its behaviour; read the linked documentation.
The “Overwrite any existing file” setting can replace an earlier dump; check it before concluding that a dump is the only one.
Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.
