Windows XP Crash Dump Options for Stop Errors

When Windows XP encounters a fatal system crash—commonly known as a Stop error or the Blue Screen of Death (BSOD)—it can save diagnostic data to a memory dump file before restarting. Windows XP offered three primary crash dump options to capture system state: Small Memory Dump, Kernel Memory Dump, and Complete Memory Dump. Each option varies in file size, the depth of system information recorded, and the disk requirements necessary for generation.

1. Small Memory Dump (64 KB)

The Small Memory Dump records the minimum amount of useful data needed to identify the general cause of a crash.

  • Contents: The Stop message, its four parameters, a list of loaded device drivers, the processor context (PRCB) for the process that crashed, the process information and kernel context (EPROCESS) for the halted thread, and the kernel-mode call stack.
  • Storage Location: Saved in the %SystemRoot%\Minidump directory. Instead of overwriting previous files, Windows XP creates a uniquely named file for each crash (e.g., Mini010105-01.dmp).
  • Requirements: A pagefile on the boot volume of at least 2 megabytes (MB).
  • Use Case: Ideal for systems with limited disk space or for transmitting crash logs across slow connections for basic triage.

2. Kernel Memory Dump

The Kernel Memory Dump was the default setting in Windows XP. It records only the memory assigned to the operating system kernel and Hardware Abstraction Layer (HAL), as well as memory allocated to kernel-mode drivers.

  • Contents: Kernel-mode addresses and structures. It completely ignores unallocated memory and memory allocated to user-mode applications.
  • Storage Location: Saved by default as %SystemRoot%\MEMORY.DMP. Subsequent crashes overwrite this file unless configured otherwise.
  • Requirements: A pagefile on the boot drive sufficient to hold kernel-mode memory. The exact size varies based on active drivers and kernel resources, but typically required between 150 MB and 800 MB on typical Windows XP configurations.
  • Use Case: The most practical dump type for administrators, providing enough depth to debug driver and kernel faults without consuming massive disk space.

3. Complete Memory Dump

The Complete Memory Dump records the entire physical contents of the system RAM at the time of the failure.

  • Contents: All kernel memory, user-mode process memory, driver code, and active hardware data.
  • Storage Location: Saved to %SystemRoot%\MEMORY.DMP and overwrites the existing file on each crash.
  • Requirements: A pagefile on the boot volume equal to the total amount of physical RAM plus 1 MB (to account for the dump header). On 32-bit systems with more than 2 GB of RAM, this option was often unavailable or required specific boot switches (/MAXMEM).
  • Use Case: Necessary for deep, advanced debugging where user-mode processes or memory corruption outside the immediate kernel space contributed to the Stop error.

Accessing Crash Dump Settings

In Windows XP, these settings were configured by right-clicking My Computer, selecting Properties, navigating to the Advanced tab, and clicking Settings under Startup and Recovery. Alongside selecting the dump type, administrators could enable or disable options to write events to the System event log, send administrative alerts, or automatically restart the computer upon failure.