Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. MEMORY.DMP
FileRisk: Safe

MEMORY.DMP C:\Windows\MEMORY.DMP

MEMORY.DMP: memory dump Windows writes on a stop error (blue screen) for crash analysis. Safe to delete once analyzed.

Updated on By AltF4 Formation

What it’s for

MEMORY.DMP is where Windows writes the contents of memory when the system stops on a critical error (blue screen, bugcheck). The default location is %SystemRoot%\Memory.dmp, set by the DumpFile value under the CrashControl key. You open it in WinDbg for post-mortem analysis, or hand it to Microsoft support.

What it contains

  • Depending on the dump type chosen (complete, kernel, automatic), all or part of physical memory at the time of the crash.
  • Small dumps are not here: they go to %SystemRoot%\Minidump.
  • The file does not exist until a crash has happened, or if the dump type is “None”.
  • To be written, it needs a large enough paging file on the system volume (see pagefile.sys).

Risks and best practices

  • You can delete it without any effect on how Windows runs, but keep it until the crash has been analyzed.
  • It holds whatever was in memory: passwords, keys, documents. Share it only with trusted parties, over a secure channel.
  • A new dump replaces the old one when “Overwrite any existing file” is ticked.
  • On a server, make sure the volume has enough free space for the configured dump type.
  • To change the behavior: Advanced system settings > Startup and Recovery.

Useful commands

Fenêtre de terminal
# Presence, size and date of the last dump
Get-Item "$env:SystemRoot\MEMORY.DMP" -Force | Select-Object FullName, Length, LastWriteTime


# Configured dump type and location
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" | Select-Object CrashDumpEnabled, DumpFile, MinidumpDir, Overwrite


# Last stop error: event 1001 in the System log (bugcheck code and dump path)
Get-WinEvent -FilterHashtable @{ LogName = 'System'; ProviderName = 'Microsoft-Windows-WER-SystemErrorReporting'; Id = 1001 } -MaxEvents 1 | Format-List TimeCreated, Message


# Open in WinDbg, then type !analyze -v
windbg -z "$env:SystemRoot\MEMORY.DMP"


# Delete after archiving or analysis (as administrator; remove -WhatIf to run)
Remove-Item "$env:SystemRoot\MEMORY.DMP" -WhatIf

Report a mistake