Windows is creating a minidump whenever it's crashing. This minidump contains data that was stored in part of the memory. The interesting aspect of this procedure is that it's relatively easy to analyse the minidump using the Debugging Tools for Windows [link]. The tool has a size of roughly 18 Megabytes and is compatible to Windows XP, Vista and Windows Server 2003 and 2008.
After installing and starting the Microsoft Debugging Tools for Windows you should add a Symbol File Path to the software by clicking on File > Symbol File Path. Enter the following information in the text field: SRV*e:\symbols*Symbol information with e:\symbols being an empty directory on your hard drive which can be changed to any other directory. Data will then be automatically downloaded from the Microsoft server. Symbols enhances debugging by automatically retrieving debugging files for various Microsoft products during a debugging session.
The next step would be to load the last minidump which is accessible in the Windows directory. A click on File > Load Crash Dump will load the minidump which takes about 20-30 seconds.
If everything went fine until this point you will see information like the one above which gives a first indication on the type of problem and file and / or hardware involved. The parameter DEFAULT_BUCKET_ID displays the type of error, for instance driver fault and process name lists the process that was involved.
Clicking on the !analyze -v link will display in depth information about the crash. The next steps depend on the type of information that you get. I usually start by doing a search on the files and error messages mentioned in the debugger which usually provide enough information to fix the issue.
Software errors for instance could be fixed by updating the software or uninstalling it if it's not necessary. Hardware errors are more often than not driver related which means a driver or bios update could fix the error.
Analyse system crashes
After installing and starting the Microsoft Debugging Tools for Windows you should add a Symbol File Path to the software by clicking on File > Symbol File Path. Enter the following information in the text field: SRV*e:\symbols*Symbol information with e:\symbols being an empty directory on your hard drive which can be changed to any other directory. Data will then be automatically downloaded from the Microsoft server. Symbols enhances debugging by automatically retrieving debugging files for various Microsoft products during a debugging session.
The next step would be to load the last minidump which is accessible in the Windows directory. A click on File > Load Crash Dump will load the minidump which takes about 20-30 seconds.
If everything went fine until this point you will see information like the one above which gives a first indication on the type of problem and file and / or hardware involved. The parameter DEFAULT_BUCKET_ID displays the type of error, for instance driver fault and process name lists the process that was involved.
Clicking on the !analyze -v link will display in depth information about the crash. The next steps depend on the type of information that you get. I usually start by doing a search on the files and error messages mentioned in the debugger which usually provide enough information to fix the issue.
Software errors for instance could be fixed by updating the software or uninstalling it if it's not necessary. Hardware errors are more often than not driver related which means a driver or bios update could fix the error.
Analyse system crashes
