Analyzing XP Pro Mini Dump Files

[wisdomwarrior23]

I understand that when XP Pro crashes you can enable it to generate a report which can help in the troubleshooting process. My clients had a machine crash consistently and so I wanted to check these files out for any clues. What I did was copy the mini dump files from their machine to a disk and then try to use Windebugger to find some clues, but what I found out is that you have to run the debugger from the actually machine that crashed even if you have the dump files. My question then is there any other way I can analyze these files?

 

[linney]

If you want the highly technical cause of a crash look in the Documents and Settings/ All Users/ Application Data/ Microsoft/ Dr Watson/ Drwtsn32.log

Find the entry that is relevant by date and time to the crash you are investigating. The exact cause of the crash is indicated by "FAULT ->" on the left of page next to line of code causing crash. This, if your as cluey as me, wont tell you much but you can use it to see if it is the same fault all the time, and further up the log you can find what processes and modules are running.

Minidump files in Windows/Minidump that correspond with the times of the error.

315263 - Reading the Small Memory Dump Files That Windows Can Create for Debugging

http://support.microsoft.com/default.aspx?scid=kb;en-us;315263&FR=1&PA=1&SD=HSCH

254649 - Windows Memory Dump File Options Overview

http://support.microsoft.com/default.aspx?scid=kb;en-us;254649&FR=1&PA=1&SD=HSCH

307973 - HOW TO: Configure System Failure and Recovery Options in Windows

http://support.microsoft.com/default.aspx?scid=kb;en-us;307973&FR=1&PA=1&SD=HSCH

How to Use Dumpchk.exe to Check a Memory Dump File

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q156280&FR=1&PA=1&SD=HSCH

It may be time to start saving your valuable data as a precaution for any forthcomming disaster or format and reinstall.

To get further information about the error look in your Event viewer.

Look in the System or Application folder. You can get to the Event Viewer via right click My Computer icon and select Manage.

Any errors logged in the Event Viewer can be expanded by double clicking on the error line.

Take any event error I.D. number and search for it on this site.

http://www.eventid.net/events.asp

Also check any "Information" line that mentions "savedump" and you should find reference to "recovered from a bug check". This is a Stop Error message, if you have them.

You can also turn off "automatically restart after an error" so it will just halt at the fault and display the full Stop Error and blue screen.

Right-click My Computer, and then click Properties .
On the Advanced tab, click Settings under Startup and Recovery .
Click to clear the Automatically restart check box under System failure , and then click OK . The error message on a blue screen should remain on the screen so you can record the error information.


Try running ChkDsk to check your drive for errors. Right click your Drive icon/ Properties/ Tools/ Error Checking.

Run the System File Checker program from the Run Box by typing.....Sfc /Scannow in it and have your XP CD handy.

HOW TO: Verify Unsigned Device Drivers in Windows XP

http://support.microsoft.com/support/kb/articles/q308/5/14.asp

If they don't work you could try repairing windows itself by running it over itself. You will lose all your windows updates but your files will be untouched.

How to Perform an In-Place Upgrade (Reinstallation) of Windows XP (Q315341)

http://support.microsoft.com/support/kb/articles/q315/3/41.asp

To look at the hardware side of things you can check your RAM out via -

http://www.memtest86.com

Your drive manufacturer will have free diagnostic tools for checking your hard drive.