Windows Kernel Crash Dump
| Format | Windows Kernel Crash Dump |
|---|---|
| Short name | Kernel dump |
| Category | memory |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Kernel-mode crash dumps written by Windows after a bug check, by default as %SystemRoot%\MEMORY.DMP. Depending on the configuration they contain the complete physical memory (complete dump), most of it (active dump) or only kernel memory (kernel and automatic dump); small memory dumps in %SystemRoot%\Minidump\ use the same kernel dump format and are distinct from user-mode minidumps ('MDMP'). The header records the dump type, bug check code and parameters and the physical memory layout; complete and bitmap-based variants allow memory analysis of processes, network connections and other volatile state at the time of the crash.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 50 41 47 45 44 55 4D 50 | PAGEDUMP | Signature 'PAGE' + valid dump marker 'DUMP' (32-bit) |
| offset 0 (0x0) | 50 41 47 45 44 55 36 34 | PAGEDU64 | Signature 'PAGE' + valid dump marker 'DU64' (64-bit) |
Known extensions
.dmp
References
- Varieties of Kernel-Mode Dump Files (Microsoft) https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/varieties-of-kernel-mode-dump-files
- Windows crash dump layer (Volatility 3 source) https://github.com/volatilityfoundation/volatility3/blob/develop/volatility3/framework/layers/crash.py
Cite this entry
Crush Format Reference, “Windows Kernel Crash Dump”. https://kalink0.github.io/crush-forensics/formats/kernel-dump/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction