Memory dump

Kernel-mode dumps

• Complete memory dump – contains full physical memory for the target system.
• Kernel memory dump – contains all the memory in use by the kernel at the time of the crash.
• Small memory dump – contains various info such as the stop code, parameters, list of loaded device drivers, etc.
• Automatic memory dump (Windows 8 and later) – same as Kernel memory dump, but if the paging file is both System Managed and too small to capture the Kernel memory dump, it will automatically increase the paging file to at least the size of RAM for four weeks, then reduce it to the smaller size.
• Active memory dump (Windows 10 and later) – contains most of the memory in use by the kernel and user mode applications.