When a kernel-mode error occurs, the default behavior of Microsoft Windows is to display the blue screen with bug check data.
However, there are several alternative behaviors that can be selected:
A kernel debugger (such as WinDbg or KD) can be contacted.
A memory dump file can be written.
The system can automatically reboot.
A memory dump file can be written, and the system can automatically reboot afterwards.
This section covers how to create and analyze a kernel-mode memory dump file. There are three different varieties of crash dump files. However, it should be remembered that no dump file can ever be as useful and versatile as a live kernel debugger attached to the system that has failed.
This section includes: