Kernel-mode dump files
There are basically three types of kernel-mode dump files:
Windows 8 introduced a fourth type: Automatic Memory Dump.
The main difference between them is the size: smaller dump files will get written quickly to disk and take less space; larger dump files will contain more debugging information which might be useful.
Another difference is the location and the overwriting behavior. Complete/kernel dumps are written to C:\Windows\Memory.dmp
by default, overwriting the previous file (if any). Small dumps are stored in the C:\Windows\Minidump
folder, and since each dump is given a different name, previous ones are preserved.
From my limited experience, I can say small dumps alone usually have enough data to diagnose basic issues. Either way, you should disable the automatic restart option. This way you can actually see the bug check technical details in case the system fails to create a memory dump.
Complete memory dump
This file includes all of the physical memory that is used by Windows. A complete memory dump does not, by default, include physical memory that is used by the platform firmware.
This dump file requires a pagefile on your boot drive that is at least as large as your main system memory; it should be able to hold a file whose size equals your entire RAM plus one megabyte.
Source: Complete Memory Dump
Kernel memory dump
This kind of dump file is significantly smaller than the Complete Memory Dump. Typically, the dump file will be around one-third the size of the physical memory on the system. Of course, this quantity will vary considerably, depending on your circumstances.
For most purposes, this crash dump is the most useful. It is significantly smaller than the Complete Memory Dump, but it only omits those portions of memory that are unlikely to have been involved in the crash.
Source: Kernel memory dump
Small memory dump
This kind of dump file can be useful when space is greatly limited. However, due to the limited amount of information included, errors that were not directly caused by the thread executing at time of crash may not be discovered by an analysis of this file.
Source: Small memory dump
Further reading
@magicandre1981 how big is the kernel memory dump? – barlop – 2015-10-02T09:27:24.627
@barlop look in taskmgr for the pool usage. This depends on the drivers that you have installed. – magicandre1981 – 2015-10-02T16:00:53.647
@magicandre1981 just paged, not non paged? or paged + non paged? – barlop – 2015-10-03T10:26:30.430
@barlop this is a good question. I would say non paged + all pages from "paged" that are in RAM and NOT paged out to disk. From Windows Internals Book: "A kernel memory dump contains only the kernel-mode pages allocated by the operating system and device drivers that are present in physical memory at the time of the crash. [..] In addition, all data structures relevant for crash dump analysis—including the list of running processes, the kernel-mode stack of the current thread, and list of loaded drivers—are stored in nonpaged memory that saves in a kernel memory dump. – magicandre1981 – 2015-10-03T15:47:21.300
"There is no way to predict the size of a kernel memory dump because its size depends on the amount of kernel-mode memory allocated by the operating system and drivers present on the machine. " – magicandre1981 – 2015-10-03T15:47:36.947
@magicandre1981 Logically, as "its size depends on the amount of kernel-mode memory allocated by the operating system and drivers present on the machine." <-- Then surely it is possible to , not predict, but state without needing to even predict, the size of a kernel memory dump! (despite what your quote goes on to say about it thus being impossible.. the reason it gives suggests that it is possible!) – barlop – 2015-10-03T15:54:28.433
I've always used Kernal memory dump. I was told it includes more detailed information regarding the circumstances... but then again I've never needed more detailed information... debugging is pretty straight forward. – Joe – 2014-02-16T01:59:18.147
1kernel dump includes more details and is better to debug the cause of a BSOD. – magicandre1981 – 2014-02-16T07:28:54.783