The standard tool used by Microsoft is . Here is a quick start guide:

This command tells the debugger to analyze the crash and tell you exactly which driver or process caused the Blue Screen.

Once located, the minidump file can be analyzed using:

| Cause | Explanation | Resolution | | :--- | :--- | :--- | | | The pagefile must be on the boot volume and at least 2 MB larger than the dump size. | Set pagefile to System managed on C:\ . | | Insufficient disk space | Minidumps require free space on C:\ . | Free up space; minidumps need ~1 MB each. | | Post-crash cleanup tools | Disk Cleanup, Storage Sense, or third-party cleaners delete .dmp files. | Exclude *.dmp from cleanup tools or disable automatic cleanup. | | Write protection or security software | Antivirus or endpoint protection blocks write to C:\Windows\Minidump . | Temporarily disable real-time protection to test. | | Registry misconfiguration | CrashDumpEnabled value is not set to 3 . | Verify registry key under HKLM\...\CrashControl . | | VBS / Hypervisor-protected code integrity | Secure kernel may prevent dump writes. | Check Event Viewer for BugCheck errors; disable Memory Integrity temporarily for testing. |

Armed with this new information, John quickly navigated to the specified folders. Indeed, he found the minidump file he was looking for in C:\Windows\Minidump . With the file in hand, John was able to analyze it using the WhoCrashed tool and identify the root cause of the application crash.

C:\Windows\Minidump