Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
A minidump is a structured crash-dump file containing selected information about a program or Windows system when it fails. It gives a debugger clues such as the exception or stop code, thread context, call stacks, loaded modules, and selected memory—without saving all of RAM.
That makes a minidump faster to create and easier to share than a full memory dump, but it also limits what can be proved. A minidump is evidence for troubleshooting, not an automatic answer and not definitive proof that the driver or module named by a debugger caused the crash.
What is a minidump used for?
Windows and applications can create dump files after failures such as:
- An application terminating because of an unhandled exception
- A Windows stop error, commonly called a blue screen
- A failure detected by Windows Error Reporting
- A crash captured by a postmortem debugger or vendor tool
- An administrator or developer intentionally recording a process dump
In ordinary Windows support, “minidump” usually refers either to a user-mode dump from one crashing application or a Windows small memory dump created after a system crash. Other operating systems use related terms such as core dump or crash report, and not every .dmp file uses Microsoft’s minidump format.
#1 Best Overall
What does “mini” mean?
“Mini” means selective, not necessarily tiny in every case. A full dump attempts to preserve substantially more memory. A minidump contains only the data selected by its creator and dump-type options.
The Windows minidump format is stream-based. Software can choose which streams to write, including exception data, thread information, modules, handles, and memory ranges. Microsoft documents the APIs used to create and read these files, including MiniDumpWriteDump and MiniDumpReadDumpStream.
As a result, “minidump” does not precisely describe how much information a file contains. Some user-mode files called minidumps can contain more useful data than another dump described as a full user-mode dump, depending on the options chosen.
What is inside a minidump?
The exact contents vary, but a dump may include:
- Metadata: A dump header and information about the operating system, process, processor, and dump type.
- Failure details: An application exception, Windows bug-check code, parameters, or faulting instruction.
- Thread context: The threads that were running and their processor registers at the time of failure.
- Call stacks: A record of functions that led to the failure, when the stack and symbols are usable.
- Loaded modules: Executables, DLLs, drivers, and their versions or addresses.
- Selected memory: Memory pages or ranges chosen by the dump configuration.
- Additional streams: Handles, unloaded modules, process environment data, and other information when enabled.
A minidump is binary debugger input. It is not a normal text log and is not meant to be read in Notepad.
Minidump versus a full memory dump
| Characteristic | Minidump or small dump | Full or larger dump |
|---|---|---|
| File size | Usually smaller | Often substantially larger |
| Creation and transfer | Faster and easier to collect | Slower and harder to store or upload |
| Diagnostic detail | Limited or selectively captured | More complete memory evidence |
| Privacy exposure | Lower than a full dump, but not zero | Greater because more memory may be included |
| Best use | Initial triage and repeated crash comparison | Difficult cases requiring deeper memory inspection |
| Guaranteed root cause? | No | No |
A larger dump is not automatically “better” for every situation. It provides more evidence, but it can take longer to create, consume significant storage, and expose more data. A minidump is often the right first artifact for support escalation.
Where does Windows save minidumps?
Windows small memory dumps are commonly stored in:
%SystemRoot%MinidumpOn a typical installation, that is:
C:WindowsMinidumpThe location can be changed, and Windows may create another dump type instead. If the folder is empty, also check for:
C:WindowsMEMORY.DMP, which may contain a larger system dump- A customized dump path in Windows recovery or system settings
- Application-specific dump locations
- Windows Error Reporting local dumps configured under
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsWindows Error ReportingLocalDumps
For application crashes, local user-mode dumps can be configured with Windows Error Reporting. Microsoft documents that configuration at Collecting User-Mode Dumps.
How to configure future Windows small dumps
On supported Windows installations, the general path is:
- Open System Properties.
- Open the Advanced tab.
- Under Startup and Recovery, select Settings.
- Under Write debugging information, choose the required dump type.
- Check the dump-file or small-dump directory.
- Apply the settings and restart if Windows requests it.
Labels and available options vary by Windows release, edition, and administrative policy. Microsoft’s documentation on memory dump file options provides the authoritative details for the relevant configuration.
How to open a minidump with WinDbg
WinDbg is Microsoft’s primary debugger for Windows user-mode and kernel-mode crash dumps. The current WinDbg documentation supports installation through a direct installer, Microsoft Store, or Windows Package Manager. On a supported Windows 10 or Windows 11 system, you can install it with:
winget install Microsoft.WinDbgTo update a WinDbg installation managed by Windows Package Manager:
Recommended Free Tools
winget upgrade Microsoft.WinDbgMicrosoft lists Windows 11 and Windows 10 Anniversary Update, version 1607, or later for the current version, with x64 and ARM64 support. WinDbg Classic remains relevant for some older Windows versions and established legacy workflows.
Open the file in the graphical interface
- Open WinDbg.
- Choose File > Open crash dump, or press
Ctrl+D. - Select the
.dmpor.mdmpfile. - Wait for the dump and symbols to load.
- Run
!analyze -vin the debugger command window.
You can also open a dump from the command line with a symbol path and dump path. A Microsoft-documented example is:
windbg -y "srv*C:Symbols*https://msdl.microsoft.com/download/symbols" -i C:Windowsi386 -z C:WindowsMinidumpminidump.dmpThe .dmp and .mdmp extensions are common, but an extension alone does not identify the dump’s contents. The debugger must inspect the file header and streams.
Why symbols matter
Symbol files, commonly PDB files, help WinDbg translate memory addresses into meaningful function and variable names. Without matching symbols, output may show raw addresses, incomplete stacks, or vague module names.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A typical symbol setup in WinDbg is:
.sympath srv*C:Symbols*https://msdl.microsoft.com/download/symbols
.reload
!analyze -v.sympath sets the symbol path, while .reload tells WinDbg to search for and load symbols. Public symbols do not expose every private implementation detail, and correct symbols cannot compensate for information that the dump never captured.
Which WinDbg output should you examine?
For an initial pass, look for:
- Bug-check code: The Windows stop code and its parameters.
- Exception code: Particularly useful for application crashes.
- Probably caused by: A preliminary suspect generated by the debugger.
- Faulting instruction pointer: The address where execution failed or was detected.
- Process name: The application or system process involved.
- Stack trace: The chain of calls around the failure.
- Loaded modules and driver versions: Useful when comparing versions or recent changes.
- Symbol warnings: Missing, mismatched, or deferred symbols can reduce confidence in the output.
Useful commands include:
!analyze -v
lm
lmvm module_name
k
kv
.bugchecklm lists loaded modules, lmvm shows details for a named module, k and kv display stack traces, and .bugcheck displays bug-check information when available.
Can a minidump identify the faulty driver?
Sometimes, but not reliably by itself. A minidump can show the failing thread, instruction pointer, bug-check parameters, modules on the stack, and patterns repeated across several crashes. However, the module named by !analyze -v may be:
- The component that detected the problem
- The component that happened to be executing at the time
- A victim of memory corruption
- A Microsoft component involved in a failure caused by third-party software or hardware
“Probably caused by” is a lead, not a verdict. Compare several dump files and correlate the output with driver updates, hardware changes, Event Viewer, Reliability Monitor, hardware diagnostics, application logs, and the steps that reproduce the crash.
Why a minidump may not solve the problem
A minidump may be insufficient when the failure involves:
- Heap corruption or memory overwritten well before the crash
- Race conditions and timing-dependent behavior
- A corrupted stack
- Large memory regions that were not captured
- Security investigations requiring broader memory evidence
- Hardware faults that cause a freeze, reset, or power loss rather than a Windows bug check
Missing symbols can make analysis less readable, but they do not always make all analysis impossible. An incomplete or damaged dump, an unsuitable image path, or a mismatch between the dump’s Windows build and available symbols can also produce weak results.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What if the dump will not open?
The file is corrupt or incomplete
Copy it again from the original location. If it was transferred inside an archive, obtain a complete copy and avoid analyzing a partially uploaded file.
Symbols will not load
Check internet access, the symbol-server syntax, cache permissions, and whether the symbols match the binaries in the dump. Run .sympath to inspect the configured path and .reload to retry loading.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →The stack is empty or confusing
The dump may not contain enough memory, the stack may be corrupted, or symbols may be missing. Try several dumps and compare their stop codes, process names, and module patterns.
Best Value
No minidump exists
Dump creation may be disabled, the paging-file configuration may be unsuitable, or the crash may have occurred before Windows could write the file. A power loss, hardware reset, or system freeze may not produce a software crash dump at all.
The Minidump folder is empty
Check the configured dump path and look for C:WindowsMEMORY.DMP or an application-specific dump location. The system may have been configured for a kernel, complete, automatic, or active dump instead of a small dump.
Is it safe to delete a minidump?
It is generally reasonable to delete old dump files after preserving them for support or analysis. Deleting one does not repair the underlying crash; it only removes evidence that could help investigate it. A future crash may create another file if dump collection remains enabled.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteBefore deleting a useful dump, keep the original in a clearly named archive and record the crash date, Windows version, recent driver or hardware changes, and reproduction steps. A minidump contains less memory than a full dump, but selected memory can still include sensitive fragments such as application data, paths, or identifiers.
Should you share a minidump?
Share it only with a trusted software vendor, IT administrator, or support technician who needs it. Follow the recipient’s instructions about whether to include logs, application versions, or a compressed archive. Do not assume that a smaller file is automatically free of private information.
When do you need a larger or different dump?
A larger dump or targeted capture may be justified when repeated minidumps do not explain the failure:
- Kernel memory dump: Useful when the issue involves kernel state or drivers and a small dump lacks evidence.
- Complete memory dump: Preserves more memory, but requires more storage and has greater privacy exposure.
- Active memory dump: Can capture relevant active memory while omitting some pages, depending on Windows configuration and diagnostic needs.
- User-mode local dump: Targets one failing application and can be configured through Windows Error Reporting.
- ProcDump: Microsoft Sysinternals’ command-line utility for capturing user-mode dumps in response to crashes or selected conditions.
- Time Travel Debugging: Records execution for replay in suitable developer scenarios; it is more demanding and is not a replacement for every crash dump.
Use a larger dump when the diagnostic question requires memory that a minidump does not contain—not simply because the larger file sounds more authoritative.
Free tools Windows power users keep installed
One-click scans. No signup required.
How a minidump differs from other evidence
| Evidence | What it shows |
|---|---|
| Screenshot | What the user saw, not the underlying execution state |
| Event log | Recorded events and messages, which may omit the failing call stack |
| Application log | Application behavior and errors, often without low-level crash state |
| Minidump | A structured debugger-readable snapshot of selected crash state |
| Full memory dump | More complete memory evidence with greater storage and privacy costs |
| Live debugging | Direct observation of a running or failing process rather than retrospective analysis |
The practical takeaway
A minidump is usually the right starting point for investigating a Windows crash: it is compact, structured, and often contains enough context to reveal a recurring stop code or suspicious pattern. Open it with WinDbg, configure matching symbols, begin with !analyze -v, and treat the result as a lead. If the dump is incomplete, the stack is corrupted, or different crashes implicate unrelated modules, preserve the evidence and escalate to a larger dump or more targeted diagnostic process.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
