I have a dump file and I would like to know its "type", for example according
Collecting User-Mode Dumps user mode dump has three basic DumpType
: 0: Custom dump
, 1: Mini dump
, 2: Full dump
.
According to Varieties of Kernel-Mode Dump Files kernel mode dump has five types: Complete Memory Dump, Kernel Memory Dump, Small Memory Dump, Automatic Memory Dump, Active Memory Dump.
Load the DMP file in WinDbg. The type will be displayed once loaded, for example:
Loading Dump File [C:\etc\notepad.DMP]
User Mini Dump File with Full Memory: Only application data is available
While the DMP is loaded, the type can be retrieved with the ||
command:
0:000> ||
. 0 Full memory user mini dump: C:\etc\notepad.DMP