What is inside a Windows minidump?

The stop code and its parameters, the list of loaded drivers, the processor and process context at the crash and the kernel-mode stack of the crashing thread. It does not hold the rest of memory, so it names the faulting module for most bug checks but cannot show what other programs were doing.

What is the difference between a kernel dump and a full memory dump?

A kernel memory dump holds the memory the kernel and drivers were using, and leaves out ordinary user programs. A full (complete) memory dump holds all of physical memory. The kernel dump is smaller and usually enough to find a driver bug; the full dump is for when something outside the kernel's own memory is needed.

What does a Linux core dump contain?

The memory image of one process when it crashed, with its registers and memory mappings. A kdump vmcore is the equivalent for the kernel, and what it holds depends on how it was filtered when saved. gdb reads a core, and the crash utility reads a vmcore.

Decision guide

What is inside a Windows crash dump (and a Linux core)?

What a Windows minidump, kernel dump, full dump and a Linux core or vmcore hold, what each lets you answer, and which one to ask for.

Published 2026-10-31 by PerformanceInsights.ai

Short answer: A Windows minidump holds the stop code, the loaded drivers and the stack of the crashing thread. A kernel dump adds the memory the kernel and drivers were using, and a full dump holds all of physical memory. On Linux, a core file is one process's memory and a vmcore is the kernel's. The bigger the dump, the more questions it can answer, and the more of the machine's data it can hold.

The Windows dump types

Dump	What it holds	What it can answer
Minidump (small memory dump)	The stop code and its parameters, the list of loaded drivers, the processor and process context at the crash, and the kernel-mode stack of the thread that stopped.	Which module faulted and how it got there. Enough for most bug checks.
Kernel memory dump	All the memory the kernel and drivers were using at the crash. Not ordinary user programs' memory, and not memory that was unallocated.	What other drivers and kernel structures were doing: pool corruption, a stuck IRP, what held a lock.
Complete (full) memory dump	All of physical memory at the crash.	Anything in memory, including user programs. Large: about the size of the machine's RAM.
User-mode dump (an application dump)	One process. A minidump of a process holds its threads and modules; a dump with full memory holds the whole process.	Why one program crashed or hung.

Windows can also save an automatic memory dump, which is a kernel memory dump that Windows sizes for you, and an active memory dump, a full dump with some memory that is unlikely to matter left out. Which type a machine writes is set in Startup and Recovery; how to find the dump and open it in WinDbg is in the minidump guide.

The Linux equivalents

Core file (a process dump): the memory image of one process when it crashed, with its registers and memory mappings. A core of a database or web server is a full application dump, with all that process held.
kdump vmcore (a kernel dump): the kernel's memory after a panic, saved by a second kernel. Tools such as makedumpfile can filter out some page types, so what a vmcore holds depends on how it was set up.

Reading them with gdb and the crash utility is in Linux core dumps with gdb and crash.

Which one to ask for

Start with the minidump. For most bug checks, such as 0x3B, 0xD1 or 0x133, it names the faulting module.
Ask for a kernel memory dump when the stack points at a victim rather than the cause, for example pool corruption (see 0x50) or a driver waiting on another (see 0x9F).
Ask for a full memory dump only when something outside the kernel's memory is needed, such as a user program that was involved.

What a dump can expose to the person who receives it is a separate question, answered in is it safe to send a customer's crash dump. If the dump is too big to move, or there is no debugger on the machine, that is the next guide in this series; until then, analyze it yourself or hand it off covers the choice.

Common questions

What is inside a Windows minidump?: The stop code and its parameters, the list of loaded drivers, the processor and process context at the crash and the kernel-mode stack of the crashing thread. It does not hold the rest of memory, so it names the faulting module for most bug checks but cannot show what other programs were doing.
What is the difference between a kernel dump and a full memory dump?: A kernel memory dump holds the memory the kernel and drivers were using, and leaves out ordinary user programs. A full (complete) memory dump holds all of physical memory. The kernel dump is smaller and usually enough to find a driver bug; the full dump is for when something outside the kernel's own memory is needed.
What does a Linux core dump contain?: The memory image of one process when it crashed, with its registers and memory mappings. A kdump vmcore is the equivalent for the kernel, and what it holds depends on how it was filtered when saved. gdb reads a core, and the crash utility reads a vmcore.

Have a dump open?

Upload a minidump to DumpTriage. It runs the debugger, reads the output and sends back the faulting module, the stack and a plain-language root cause (how the analysis works). Cases the automated passes can't settle go to an engineer. Free during the pilot.

Create an account