Windows Minidump
| Format | Windows Minidump |
|---|---|
| Short name | MDMP |
| Category | memory |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
A partial user-mode process memory dump written on application crashes (Windows Error Reporting, e.g. %LOCALAPPDATA%\CrashDumps) or on demand. Streams describe the threads, loaded modules with versions and timestamps, exception record, system information and selected memory ranges of the process; the header records when the dump was written. Dumps of lsass.exe are a common sign of credential theft. Kernel crash dumps (MEMORY.DMP, %SystemRoot%\Minidump) use a different format.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 4D 44 4D 50 93 A7 | MDMP.. | Signature 'MDMP' followed by format version 0xA793 |
Known extensions
.dmp, .mdmp
References
- MINIDUMP_HEADER structure (Microsoft) https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_header
- Minidump (MDMP) format (libyal/libmdmp) https://github.com/libyal/libmdmp/blob/main/documentation/Minidump%20(MDMP)%20format.asciidoc
Cite this entry
Crush Format Reference, “Windows Minidump”. https://kalink0.github.io/crush-forensics/formats/mdmp/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction