Verifying the Creation of a Kernel-Mode Dump File

  • Článek

If you have a machine that has broken into the debugger, but you are unsure whether the crash dump file was successfully written, execute the following command:

dd nt!IopFinalCrashDumpStatus L1

This displays the value of the IopFinalCrashDumpStatus variable.

If this value equals zero, the process was successful. If it equals -1 (0xFFFFFFFF), the dump process has not started.

Any other value is a status code indicating an error during the dump process.