how to analyze system crash(memory dump)of windows

Here are simple instructions on how to do it:

1. Make sure that the memory was dumped. To configure it (in XP, in W2K it's similar):

  1.

     Start -> Control Panel -> System -> Advanced -> 'Startup and
     Recovery - click on the 'Settings' button

  2. Make sure under 'System failure' 'Automatically restart' is NOT
     checked; 'Write debugging information' should be set to 'Complete
     memory dump'. You may need to restart the OS.

2. After a BSOD occurred, wait until it is completely written before rebooting the OS. 3. After the OS completed booting, you can look at the memory dump (usually, under %SystemRoot%\memory.dmp - which is usually c:\windows\memory.dmp), using the Debugging Tools for Windows (install from http://www.microsoft.com/whdc/devtools/debugging/installx86.Mspx ). Note! If you use it on 64bit OS, you need the amd64 version). 4. Open WindDbg (Start->All Programs->Debugging Tools for Windows ->WinDbg), go to File->Symbol File Path and enter: SRV* If you have your own symbols as well, use: srv*c:\symbols*

5. Open the crash dump using File->Open Crash Dump

6. Run the command '!analyze -v' (this may take a while).

Copy the whole output - it may be relevant.