Capturing Blue Screen of Death (BSOD) screen

Possible Duplicate:
PC Blue Screens and then instantly reboots. How do I stop this or find the error later?

Sometimes I get a BSOD screen for a split second and I have no chance to see the cause of it. It also happens when I am not at the computer. The event log doesn't have enough information. Is there a way or tool that captures the screen when it happens so I can look at the cause later.

I already did a memory diagnostics test so that's not the problem.

Tony_Henrich

Posted 2010-07-21T16:26:35.567

Reputation: 9 154

1thats what cell phone cams are for are they not? – user33788 – 2010-07-21T19:27:39.667

Sure. I will sit infront of the computer for hours holding a camera and when the BSOD shows up for a split second, I will be quick enough to capture it!! – Tony_Henrich – 2010-07-22T16:59:23.210

@user: Good luck then afterwards trying to decipher what's written on the screen. In my experience cell phone cameras hardly have any optical qualities you might describe as "good". – Joey – 2010-10-05T10:04:06.630

Answers

All BSODs are stored on your computer. The freeware BlueScreenView not only recreates the BSOD display as-it-was, but also tries to analyze the dumps and find the guilty program/driver for you:

BlueScreenView scans all your minidump files created during 'blue screen of death' crashes, and displays the information about all crashes in one table. For each crash, BlueScreenView displays the minidump filename, the date/time of the crash, the basic crash information displayed in the blue screen (Bug Check Code and 4 parameters), and the details of the driver or module that possibly caused the crash (filename, product name, file description, and file version).
For each crash displayed in the upper pane, you can view the details of the device drivers loaded during the crash in the lower pane. BlueScreenView also mark the drivers that their addresses found in the crash stack, so you can easily locate the suspected drivers that possibly caused the crash.

harrymc

Posted 2010-07-21T16:26:35.567

Reputation: 306 093

Check your C:\WINDOWS\Minidump folder for any .dmp files in there, zip them up and upload them to a file sharing site where we can download to analyze them for you.

Moab

Posted 2010-07-21T16:26:35.567

Reputation: 54 203

@Moab There is no guarantee that there is no personal information in a crash dump, even a minidump. Kernel and automatic dumps contain every valid page of kernel address space. Full dumps contain all of RAM. Even minidumps contain a few pages of memory and one simply cannot say that there is absolutlely not ever any personally identifying info in them. Granted it won't be (can't be) much, but you can't guarantee "nothing". – Jamie Hanrahan – 2015-10-02T01:21:40.833

I referred to the minidump folder which is not a full memory dump. I get your point though. – Moab – 2015-10-02T13:02:08.980

At least I wouldn't voluntarily give everyone my crash dumps. – Joey – 2010-07-22T08:51:55.827

-1 for you also Johannes, there is no personal info in a crash dump, they are posted on forums by the tens of thousands. You might at least explain your position before down voting a legitimate answer. – Moab – 2010-07-22T21:37:56.880

In addition to all the programs and drivers on the system, there is also drive/directory structure stored in the dumps. Those aren’t necessarily bad, but would you tell the whole world how your files and folders are laid out and what programs you run (porn.exe)? :-) – Synetech – 2011-05-05T18:07:35.420

In the advanced system properties, in the startup and recovery options there's a checkbox to automatically restart (upon system failure). Uncheck this checkbox. The next time the machine has a BSOD, it will be left on the BSOD screen and you'll be able to write down or take a picture of the info and Google it for more answers (or post it here).

joeqwerty

Posted 2010-07-21T16:26:35.567

Reputation: 5 259

You could disable the auto restart on error but this is not always the safest practice. Another option would be to get windows (assuming this is XP) to write a dump to the harddisk. These can then be analysed later (preferably using something like winDBG).

Right click My Computer -> Properties. Click Advanced tab. Click Settings under Startup and Recovery. The exact next step escapes me but I think it is tick the Write Debug Log info to hard disk. This should right a dmp file to %SYSTEMROOT%\Minidumps the next time you get a BSOD. Instructions on how to use WinDBG can be found over at Tech Republic though you could probably post a link here and someone will help.

Tim Alexander

Posted 2010-07-21T16:26:35.567

Reputation: 1 798

Why is it not safe to disable the automatic restart upon system failure? What's going to happen other than it will stop on the BSOD instead of rebooting? – joeqwerty – 2010-07-21T18:15:59.000

I suppose if the system needs to be up for some reason, leaving it on the blue screen would be undesirable, but I wouldn't consider it unsafe. – Tofystedeth – 2010-07-21T19:22:16.620

Every bluescreen gets logged in the Event log, so even if you don't catch it as it happens you can still find out the STOP code and its parameters.

Joey

Posted 2010-07-21T16:26:35.567

Reputation: 36 381

Not true. A BSOD is an unexpected event and therefore won't be logged. The event log will log the startup after the BSOD with an event that states that the previous system shutdown was unexpected. The best you could do would be to configure a memory dump in the advanced system options and analyze the dump file after the fact. – joeqwerty – 2010-07-21T18:18:54.453

1@joeqwerty: Only a very few BSODS depending on type and when they happen will not make it into the event log, though the computer needs to be set to write an event to the log. – Tofystedeth – 2010-07-21T19:23:23.063

@Tofystedeth: That's the default setting, so unless they fiddled with it I would assume it's still set. – Joey – 2010-07-22T08:53:37.523