1

I've got a machine that bluescreens, but will not write out any sort of dump file (mini, kernel or otherwise). I've fiddled with the swap file so it be large enough to handle the dump. Only the C:\ drive is defined on the machine, so the potential issue of having the swap file on a different drive is not a factor.

Checking the event log, there an entry which corresponds to the BSOD that reads:

"Crash dump initialization failed"

In the details for this event, there is a reference to the hard drive. Presumably, this is where the dump would have been written to:

\Device\HarddiskVolume2

However, there is only one physical hard drive and a single partition/volume defined. The System Information utility (msinfo32.exe) shows the drive name to be:

\Device\HarddiskVolume1

Seems like Windows the crash dump is failing as it wants to write onto "Volume2", which does not exist.

I'm wondering if the \Device\HarddiskVolume2 string might be editable and could be changed to \Device\HarddiskVolume1? Registry, BIOS and the other usual locations have been checked, but with (unsurprisingly) no luck. I'm out of ideas.

Any suggestions appreciated.

Improve this question
0

Look in the registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl

You'll find several entries, such as DumpFile and MinidumpDir

Typically, the default location is defined by the environment variable SystemRoot...

I believe the registry also contains the default SystemRoot value here:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot

If those variables aren't pointing to the correct location, it's possible that your mount points are screwed up. Check HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices under \DosDevice\C: (probably) and make sure the binary data is pointing to the correct volume. (Sorry, the reg-value is in "REG_BINARY" format... but you should be able to convert the hex to ascii to make it readable.)

Improve this answer
3
  • The registry entries are all present and pointing at valid folders. Made sure the %SystemRoot% variable expands to the correct windows location (i.e. C:\Windows). The MountedDevices key/folder does contain a number of entries. But after decoding the hex, they were all just mounts for USD drive that must have been inserted into the machine. – user1617242 Jan 29 '20 at 20:39
  • I think we need to know how and where windows uses "Device\HarddiskVolumeX" and maps it to a drive letter. I've done some looking into NTFS mounting points and symbolic links, but these don't seem like likely suspects. – user1617242 Jan 29 '20 at 20:53
  • Which registry were you looking at? ... the one in the recovery disk? or the one for the OS that keeps blue-screening? You probably need to load the registry of the broken system. – TheCompWiz Jan 30 '20 at 19:24
0

Check the registry for the default folder for crash dumps.

This is found under the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl. The values of these should be:

  • MinidumpDir : %SystemRoot%\Minidump
  • DumpFile : %SystemRoot%\MEMORY.DMP

You may also do so via Control Panel > System > Advanced system settings, Advanced tab, under Startup and Recovery click the Settings button, set "Dump file" to %SystemRoot%\MEMORY.DMP and click OK.

Improve this answer
6
  • Yep, I've checked those locations and they are correct. Also made sure the %SystemRoot% variable expands to the correct windows location (i.e. C:\Windows). – user1617242 Jan 29 '20 at 18:29
  • Nave you disabled the pagefile or reduced it? Windows needs this file to create crash dumps, and it should be large enough to contain the dump across the reboot. – harrymc Jan 29 '20 at 19:45
  • The machine has 4GB of memory. I've set the page file to use 5000MB - 19000MB. – user1617242 Jan 29 '20 at 20:36
  • Full dump or minidump? – harrymc Jan 29 '20 at 20:38
  • Tried both mini and kernel. – user1617242 Jan 29 '20 at 20:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.