Windows first saves crash dumps to the pagefile. It only moves the data into a separate file after reboot. Why must they go into the pagefile first?

0

Windows first saves crash dumps to the pagefile. Windows only moves the data into a separate file (either a Memory.dmp file or a minidump file) after reboot.

Why must crash dumps go into the pagefile first?

unforgettableidSupportsMonica

Posted 2017-09-28T01:45:40.227

Reputation: 983

Question was closed 2017-09-28T02:22:35.387

Answers

0

LMiller7 answers:

I believe the reason is to have a better chance of creating a reliable crash dump. At the time of the BSOD the system is in an unstable state and it is unknown as to the root cause or it's full implications. The system is of course not in a position to make such judgements for the same reason that a psychiatrist could not be trusted to make a judgement of his own mental state.

Thus, when making a crash dump it is important to keep things as simple as possible. After all, the root cause of the BSOD might be in the file system itself. For that reason the crash dump is written to the pagefile on the system drive instead of to a newly created file. I believe this is done bypassing the file system. Writing to a pagefile on another drive would complicate this. If anything were to go wrong other files or the file system itself could be corrupted and making the problem worse.

During the reboot following the BSOD the system is presumed to be in a stable state and the crash dump is copied from the pagefile to it's final destination. The pagefile can then resume it's normal function.

unforgettableidSupportsMonica

Posted 2017-09-28T01:45:40.227

Reputation: 983