Full Diagnostic Tree & Step-by-Step Overview
What specific challenge or error are you facing while analyzing Windows BSOD memory dumps?
- Windows fails to generate MEMORY.DMP or minidump files after a BSOD crash
- WinDbg returns symbol load errors ('DBGHELP: No symbols found') or fails to analyze the dump
- !analyze -v output points to a specific third-party driver file (.sys)
- BugCheck code indicates memory corruption (0x1A, 0x50, 0xBE) or power/hardware failure (0x124, 0x9F)
Why is Windows not saving crash dump files to disk?
- Pagefile is disabled, improperly sized, or crash dump setting is misconfigured in system properties
- Storage controller or SSD drops off the bus during crash before dump file can be written
Enable & Configure Windows Crash Dump Generation
Solution:
Root Cause: Disabled Pagefile, Insufficient Disk Space, or Misconfigured Recovery Settings
Windows requires a system-managed Paging File on the OS drive (C:) to write physical RAM contents into a dump file during a kernel panic. If the pagefile is disabled, set too small, or dump options are off, no memory dump will be created.
# Step-by-Step Fix:
Configure System Failure Recovery Settings:Press Win + R, type sysdm.cpl, and press Enter.Go to the Advanced tab -> Under Startup and Recovery, click Settings.Under Write debugging information, select Automatic memory dump or Small memory dump (256 KB).Ensure Overwrite any existing file is checked.Enable System-Managed Pagefile on System Drive:In sysdm.cpl -> Advanced tab -> Under Performance, click Settings -> Advanced tab -> Click Change under Virtual memory.Check Automatically manage paging file size for all drives (or explicitly set C: to System managed size).Verify Registry CrashDumpEnabled Key:Open elevated Command Prompt and run: reg add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v CrashDumpEnabled /t REG_DWORD /d 7 /f
Resolve Storage Bus Dropouts & Fast Startup Dump Failures
Solution:
Root Cause: NVMe/SATA Controller Disconnection or Fast Startup File Locking
When a BSOD occurs due to a storage controller crash (e.g., NVMe SSD drop), the kernel cannot write MEMORY.DMP because the target disk is offline. Additionally, Fast Startup can corrupt state saves during crash dumps.
# Step-by-Step Fix:
Disable Fast Startup:Open Control Panel -> Power Options -> Select Choose what the power buttons do.Click Change settings that are currently unavailable -> Uncheck Turn on fast startup -> Click Save changes.Update Storage Controller & NVMe Firmware:Open Device Manager -> Expand Storage controllers -> Update drivers for NVMe / AHCI controllers.Install manufacturer SSD management tools (e.g., Samsung Magician, Crucial Executive) to update SSD firmware.Set Dump Storage Registry Timeouts:Run elevated PowerShell to extend disk initialization timeouts: Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" -Name DumpSendMemory -Value 1
What exact issue occurs inside WinDbg during dump analysis?
- WinDbg cannot download Microsoft Symbol Server PDBs or reports symbol path error
- WinDbg requires administrator privileges or dump file is locked by access permissions
Configure Microsoft Public Symbol Server in WinDbg
Solution:
Root Cause: Missing or Unconfigured Microsoft Public Symbol Path
WinDbg requires symbol files (.PDB) to translate raw memory addresses into human-readable function names and source file references. Without configured symbol paths, !analyze -v returns inaccurate or incomplete output.
# Step-by-Step Fix:
Set Microsoft Symbol Path in WinDbg:Open WinDbg Preview.Click File -> Settings -> Debugging settings.Set Symbol path to: srv*C:\Symbols*https://msdl.microsoft.com/download/symbols
Set Environment Variable for System-Wide Symbol Access:Open Command Prompt as Administrator and execute: setx /M _NT_SYMBOL_PATH "srv*C:\Symbols*https://msdl.microsoft.com/download/symbols"
Force Reload Symbols in WinDbg Session:In the WinDbg command line box, type .reload /f and press Enter.Run !analyze -v again to generate the fully resolved stack trace.
Resolve File Access Permissions & Run WinDbg Elevated
Solution:
Root Cause: Insufficient File Permissions or Exclusive Locking by Windows System
Memory dump files stored in C:\Windows\MEMORY.DMP or C:\Windows\Minidump carry restrictive ACL permissions. Opening them without elevated administrator rights causes WinDbg access denied errors.
# Step-by-Step Fix:
Launch WinDbg as Administrator:Search for WinDbg in the Windows Start menu.Right-click WinDbg Preview -> Select Run as administrator.Copy Dump File to Working Directory:Create a folder on your Desktop named DumpAnalysis.Copy the target file from C:\Windows\Minidump\*.dmp or C:\Windows\MEMORY.DMP into Desktop\DumpAnalysis.Take Ownership via Command Line (If Access Denied Persists):Open elevated Command Prompt and run: takeown /f C:\Windows\MEMORY.DMP
icacls C:\Windows\MEMORY.DMP /grant Administrators:F
What type of driver binary is identified as the faulting module in MODULE_NAME?
- Third-party GPU, Wi-Fi, or audio driver (e.g., nvlddmkm.sys, netwtw08.sys, RTKVHD64.sys)
- Antivirus, VPN, or anti-cheat filter driver (e.g., eamonm.sys, vgk.sys, EasyAntiCheat.sys)
Clean Reinstall Driver via DDU or Safe Mode
Solution:
Root Cause: Third-Party Device Driver Memory Corruption or Kernel Exception
When !analyze -v reveals a specific .sys binary in MODULE_NAME or IMAGE_NAME (e.g., nvlddmkm.sys), that driver attempted an illegal memory operation, triggering a kernel safeguard BSOD.
# Step-by-Step Fix:
Identify the Faulting Driver in WinDbg Output:Inspect these lines in !analyze -v:MODULE_NAME: (e.g., nvlddmkm)IMAGE_NAME: (e.g., nvlddmkm.sys)FAILURE_BUCKET_ID: (e.g., AV_nvlddmkm!unknown_function)Perform Clean Driver Removal in Safe Mode:Boot Windows into Safe Mode.For Graphics drivers: Run Display Driver Uninstaller (DDU) to wipe driver files and registry keys.For Network/Audio drivers: Open Device Manager -> Right-click device -> Uninstall device (check Attempt to remove the driver for this device).Reinstall Latest WHQL Certified Driver:Download and install the latest official driver from the original hardware vendor website (e.g., NVIDIA, Intel, Realtek).
Remove Third-Party Security/Anti-Cheat Drivers & Enable Driver Verifier
Solution:
Root Cause: Antivirus, VPN, or Kernel Anti-Cheat Filter Driver Interference
Filter drivers register low-level I/O callbacks in the Windows kernel stack. Anti-cheat software (e.g., vgk.sys, EasyAntiCheat.sys) or security suite filters frequently cause IRQL conflicts or memory access violations.
# Step-by-Step Fix:
Uninstall Conflicting Filter Driver Package:Navigate to Settings > Apps > Installed apps.Uninstall recently updated anti-cheat engines, third-party antivirus suites, or virtual network/VPN drivers.Enable Windows Driver Verifier to Stress-Test Unsigned Drivers:Press Win + R, type verifier, and press Enter.Select Create standard settings -> Select driver names from a list.Select all non-Microsoft drivers and click Finish.Reboot the PC. If a driver crashes the system, WinDbg will log the exact culprit in the new minidump.Disable Driver Verifier After Testing:Boot into Safe Mode, open Command Prompt, and run: verifier /reset
Which specific BugCheck category did !analyze -v report?
- Memory Management / Page Fault BugChecks (0x0000001A, 0x00000050, 0x000000BE)
- WHEA Hardware Error or Power State Failure (0x00000124, 0x0000009F)
Diagnose Physical RAM Failure & Run MemTest86
Solution:
Root Cause: Physical RAM Module Corruption or Faulty Memory Timings/XMP Profiles
BugChecks like MEMORY_MANAGEMENT (0x1A), PAGE_FAULT_IN_NONPAGED_AREA (0x50), or ATTEMPTED_WRITE_TO_READONLY_MEMORY (0xBE) indicate that data written to or read from system RAM became corrupted.
# Step-by-Step Fix:
Disable Memory Overclocking (XMP / EXPO / DOCP):Restart PC and enter BIOS/UEFI setup (DEL or F2).Disable XMP / EXPO / DOCP memory profiles and set RAM frequency to standard JEDEC defaults.Run Windows Memory Diagnostic:Press Win + R, type mdsched.exe, select Restart now and check for problems.Perform Exhaustive Hardware Memory Test via MemTest86:Flash MemTest86 to a USB flash drive using Rufus.Boot from the USB drive and run at least 4 complete test passes.If errors appear, test individual RAM sticks in different DIMM slots to isolate the damaged module.
Resolve Hardware Power Delivery & PCIe Bus Voltage Drops
Solution:
Root Cause: PCIe Power State Failure (0x9F) or WHEA Uncorrectable Hardware Error (0x124)
BugCheck WHEA_UNCORRECTABLE_ERROR (0x124) indicates a physical CPU, PCIe device, or motherboard hardware fault. BugCheck DRIVER_POWER_STATE_FAILURE (0x9F) occurs when a driver fails to transition a device to a low-power state.
# Step-by-Step Fix:
Inspect WHEA Record in WinDbg:In WinDbg, execute !errrec [Address] using the address listed under Arg2 of the !analyze -v report to view CPU bank errors or PCIe bus errors.Adjust Windows Power Plan Settings:Open Control Panel -> Power Options -> Click Change plan settings -> Change advanced power settings.Expand PCI Express -> Link State Power Management -> Set to Off.Update BIOS/UEFI & Reset Factory Defaults:Flash your motherboard to the latest BIOS version to resolve CPU microcode errors.Load BIOS optimized defaults to clear unstable CPU core voltage offsets or overclocks.