Dr. Watson Crash Logs in Windows XP

In Windows XP, Dr. Watson (drwtsn32.exe) served as the built-in post-mortem debugger designed to capture system state information whenever a user-mode application encountered an unhandled exception. When an application crashed, Dr. Watson intercepted the error and generated two primary diagnostic artifacts: a detailed, human-readable text log named drwtsn32.log and a binary memory dump file named user.dmp. Together, these files provided developers and system administrators with the technical details necessary to diagnose the root cause of application failures.

The Text Log: drwtsn32.log

The primary diagnostic log generated by the tool was drwtsn32.log. Unlike binary dumps, this was a plain text file that appended new entries every time a crash occurred. It contained a comprehensive snapshot of the execution environment at the precise moment of failure, structured into several key sections:

  • System and Application Overview: The log recorded the operating system version, computer name, username, application name, process ID (PID), thread ID, and the exact timestamp of the crash.
  • Exception Information: It documented the specific exception number and type (such as an access violation 0xC0000005), along with the faulting memory address.
  • CPU Registers: A complete dump of CPU register states (including EAX, EBX, ECX, EDX, ESI, EDI, EIP, and ESP) at the point of the fault.
  • Instruction Disassembly: A sequence of assembly instructions leading up to and immediately following the instruction that caused the failure, with an arrow or marker indicating the faulting line.
  • Loaded Module List: A complete enumeration of all dynamic-link libraries (DLLs) and executable modules loaded into the process's memory space, including their base memory addresses, file sizes, timestamps, and version information.
  • Stack Backtrace: A detailed call stack showing the sequence of function calls that led to the fault, which helped identify whether the issue resided in the main executable or a third-party DLL.
  • Raw Stack Dump: A raw hexadecimal dump of the stack memory space for deeper inspection.

The Binary Crash Dump: user.dmp

In addition to the text log, Dr. Watson generated a binary crash dump file typically named user.dmp. This file captured the memory state of the process and was intended for post-mortem debugging using advanced tools such as Microsoft WinDbg or Visual Studio.

Depending on the configuration, Dr. Watson could generate:

  • Full Dump: Captured the entire process memory space, providing comprehensive data at the cost of larger file sizes.
  • MiniDump: Captured only essential debugging structures, such as thread information, call stacks, and loaded module lists, resulting in a much smaller file footprint.

Unlike the text log, which appended entries chronologically, the user.dmp file was overwritten by default on each subsequent crash unless explicitly disabled or renamed.

Default Storage Location

By default, Windows XP saved both diagnostic files in the shared application data directory:

C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\

Administrators could modify the target paths, change the dump type, toggle visual or sound notifications, and control whether to append to the log file by running drwtsn32.exe from the Run dialog to launch the Dr. Watson configuration interface.