I'm trying to fix my friend's computer. Everytime she tries to boot it we have a blue screen right after the loading bar with the XP logo. If I mount it using a live linux distro, is there a way I can find that message, like in a log file? It just reboots everytime and I can't read what it says.
Yes, use this software to read the crash dump file stored at C:\Windows\Minidump
I think you need to start Windows XP, hit F8 during booting to get to the Advanced Menu screen, and then use the "Enable Boot Logging" option. It will log all the boot messages to the ntbootlog.txt file. The log is stored in the %SYSTEMROOT% directory (normally C:\Windows folder).
After you have tried booting and Windows has crashed, you should be able to go back with your Live Linux and look at that file to see what is last action before the crash.
Take a look at this link for a bit more help.