Windows first saves crash dumps to the pagefile. Windows only moves the data into a separate file (either a Memory.dmp file or a minidump file) after reboot.

Why must crash dumps go into the pagefile first?


LMiller7 answers:

I believe the reason is to have a better chance of creating a reliable crash dump. At the time of the BSOD the system is in an unstable state and it is unknown as to the root cause or it's full implications. The system is of course not in a position to make such judgements for the same reason that a psychiatrist could not be trusted to make a judgement of his own mental state.

Thus, when making a crash dump it is important to keep things as simple as possible. After all, the root cause of the BSOD might be in the file system itself. For that reason the crash dump is written to the pagefile on the system drive instead of to a newly created file. I believe this is done bypassing the file system. Writing to a pagefile on another drive would complicate this. If anything were to go wrong other files or the file system itself could be corrupted and making the problem worse.

During the reboot following the BSOD the system is presumed to be in a stable state and the crash dump is copied from the pagefile to it's final destination. The pagefile can then resume it's normal function.

Not the answer you're looking for? Browse other questions tagged or ask your own question.