Windows 2000 Crash Dump Creation and MEMORY.DMP

When Microsoft Windows 2000 experiences a fatal system error—commonly known as a BugCheck or Blue Screen of Death (BSOD)—it preserves volatile system state by generating a crash dump file. Rather than writing directly to the filesystem during an unstable kernel state, Windows 2000 temporarily saves memory contents into the system's primary paging file (pagefile.sys) using specialized disk drivers. Upon reboot, the system extracts this data and writes it to the permanent %SystemRoot%\MEMORY.DMP file for debugging and root-cause analysis.

Pre-Crash Initialization

Windows 2000 prepares for potential crashes during the standard boot phase. Because a kernel crash compromises standard filesystem drivers (NTFS or FAT) and normal I/O routines, the operating system cannot rely on standard write operations once a panic occurs.

To prepare, the kernel initializes a specialized disk miniport driver dedicated exclusively to crash dumping. It pre-allocates memory structures and maps the physical disk sectors of the primary paging file located on the boot volume (the partition hosting %SystemRoot%). This ensures that the system knows precisely where to write raw data on the physical drive without querying the filesystem driver.

The BugCheck and Memory Capture

When a fatal error occurs, the kernel calls KeBugCheck or KeBugCheckEx. This function carries out the crash procedure:

  1. Halting System Activity: Hardware interrupts are disabled, and other processors in a multi-processor system are halted to freeze the system state.
  2. Displaying the BSOD: The system switches the video adapter to standard VGA text mode and displays the Stop code and parameter values.
  3. Invoking the Dump Driver: Control transfers to the crash dump driver.
  4. Writing to the Paging File: The driver writes the dump header and physical RAM contents directly into the pre-mapped sectors of pagefile.sys.

The dump header includes critical metadata, such as the Stop error code, processor architecture, loaded driver lists, and memory management structures.

Post-Reboot Extraction by Savedump.exe

Writing directly to MEMORY.DMP during a crash could corrupt the disk filesystem. Instead, the final file creation takes place after the operating system safely restarts:

  1. Header Detection: During early startup, the Session Manager Subsystem (smss.exe) checks the header of pagefile.sys to determine if crash data is present.
  2. Process Spawning: If a valid dump signature exists, Windows marks the paging file blocks to prevent them from being immediately overwritten and launches the Save Dump utility (savedump.exe).
  3. File Creation: savedump.exe reads the crash image from the paging file, validates the data, and writes it out to %SystemRoot%\MEMORY.DMP (or another path configured by the administrator).
  4. Paging File Release: Once the file is created on the filesystem, savedump.exe clears the dump header in pagefile.sys, allowing Windows 2000 to reclaim that disk space for standard virtual memory operations.

Crash Dump Options in Windows 2000

Windows 2000 supports three crash dump configurations via the System Properties control panel:

  • Complete Memory Dump: Writes the entire contents of physical RAM to disk. This requires a pagefile.sys on the boot partition at least 1 MB larger than the total amount of installed physical RAM.
  • Kernel Memory Dump: Captures only the kernel-mode address space, ignoring user-mode application memory. This is the default setting in Windows 2000, as it significantly reduces file size and write times while providing all necessary information to diagnose drivers and OS components.
  • Small Memory Dump (64 KB): Records only the Stop code, parameters, loaded driver list, and execution context of the faulting thread. Instead of MEMORY.DMP, this is saved to %SystemRoot%\Minidump with an incident-specific filename.