Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. DumpStack.log.tmp
FileRisk: Do not touch

DumpStack.log.tmp C:\DumpStack.log.tmp

Hidden binary file at the root of C:, tied to the memory dump stack; locked by Windows, not a readable log. Leave it in place.

Updated on By AltF4 Formation

What it’s for

The file really is called DumpStack.log.tmp (not DumpStack.log). It is a small hidden system file created at the root of the boot volume and, going by its name, tied to the dump stack, the code that writes memory dumps on a stop error. Despite the suffix it is not a log you read: the content is binary. To understand a blue screen, look at MEMORY.DMP or C:\Windows\Minidump instead.

What it contains

  • Binary data of no use to an administrator.
  • Windows keeps it locked while running, so File Explorer usually refuses to open or delete it.
  • At the root of C:, with this name and the system attribute, it is not malware. The same name anywhere else deserves a check.

Risks and best practices

  • Leave it alone. It is unobtrusive and takes almost no space, so there is no point in forcing its lock.
  • To investigate a stop error, open C:\Windows\MEMORY.DMP or a file from C:\Windows\Minidump in WinDbg.

Useful commands

Fenêtre de terminal
# Show the file (hidden, system) without touching it
Get-Item "$env:SystemDrive\DumpStack.log*" -Force | Select-Object FullName, Length, LastWriteTime, Attributes


# Memory dump configuration
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" | Select-Object CrashDumpEnabled, DumpFile, MinidumpDir


# Latest stop errors (event 1001 in the System log)
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1001; ProviderName='Microsoft-Windows-WER-SystemErrorReporting'} -MaxEvents 5 | Select-Object TimeCreated, Message

Format

Binary, with no documented structure. The .log suffix is misleading: it is not a timestamped text log.

Rotation and archiving

There is no rotation; Windows manages the file itself. The Overwrite value under CrashControl applies to MEMORY.DMP, not to this file.

How to read it

You don’t. For a stop error, open MEMORY.DMP or a .dmp from C:\Windows\Minidump in WinDbg, or look for event 1001 (BugCheck) in the System log.

Report a mistake