Where Windows 11 stores crash information

When your computer crashes or a program stops working, Windows 11 writes a record of what happened. These records live in the Event Viewer, a built-in tool that logs system errors, warnings, and other events. You do not need to dig through hidden folders or use command lines — Event Viewer shows you the crash details in one place.

Windows also saves crash dumps (detailed memory snapshots from the moment of failure) in your user folder under AppData. The Event Viewer is the fastest way to see what crashed and when. The crash dump files are there if you need to dig deeper or send them to Microsoft support.

Key Takeaways

  • Open Event Viewer by typing "Event Viewer" in the Windows search box, then look under Windows Logs > System to find crash records.
  • A red X next to an entry means an error; look for entries labeled "Critical" or with codes like 1001 or 1002 to find actual crashes.
  • The Details tab shows the error code and which program or driver caused the problem, helping you decide whether to update, reinstall, or replace hardware.
  • Crash dump files are saved in C:\Users\[Your Username]\AppData\Local\Temp if you need to send them to support or analyze them with specialized tools.

Opening Event Viewer and finding the System log

Press the Windows key and type "Event Viewer" without quotes. Click the result labeled Event Viewer. The window that opens shows a tree on the left side with folders. Click the arrow next to "Windows Logs" to expand it, then click "System".

The System log is where Windows records hardware failures, driver crashes, and system-level errors. You will see a list of events with dates, times, and brief descriptions. Each row has a colored icon on the left: a red X means an error, a yellow triangle means a warning, and a blue circle means information. Crashes show up as red X entries.

Identifying actual crashes in the log

Not every red X is a crash. Look for entries with the word "Critical" in the Level column, or entries with Event ID 1001, 1002, or 1003. These are the ones that usually mean your system stopped working or a major program failed. Scroll down to see the most recent events first — Event Viewer shows newest at the top by default.

Click on an entry to select it. The bottom pane shows more details: the time it happened, which component failed, and sometimes a brief description. If you see the same error repeating every few minutes or hours, that is a sign the problem is ongoing and not a one-time glitch.

Reading the Details tab for error codes

Right-click on a crash entry and select "Copy" or click the entry once and look at the bottom pane. You will see fields like "Source" (which part of Windows or which driver caused it), "Event ID" (a number that categorizes the type of failure), and "Description" (what went wrong). The Description field often tells you whether a driver crashed, a hardware device failed, or a system service stopped.

Error codes like 0x0000007E or 0x00000050 are stop codes — they tell you the type of failure. A code starting with 0x00000 is a kernel error (the core of Windows crashed). If the Description mentions a specific driver name like "nvlddkm.sys" (NVIDIA graphics) or "Ntfs.sys" (file system), that driver is the culprit. Write down the driver name or error code so you can search for it or tell support what happened.

Finding crash dump files on your computer

Crash dumps are saved in a folder that is hidden by default. Open File Explorer and type this path in the address bar: C:\Users\[Your Username]\AppData\Local\Temp. Replace [Your Username] with your actual Windows username. Press Enter.

Look for files with names like "WER" (Windows Error Reporting) or files ending in .dmp. These are the full crash dumps. They are large files (often 100 MB to several GB) and are meant for detailed analysis by support teams or specialized debugging tools. If you are sending crash information to Microsoft support or a hardware manufacturer, these files are what they will ask for.

What to do once you have found the crash

Once you know what crashed, you have a few options. If the error mentions a driver (like a graphics driver, network driver, or chipset driver), go to the manufacturer's website and read the latest version. Outdated drivers cause many crashes. If it is a Windows system file, run Windows Update to get the latest patches.

If the crash mentions a specific program, try uninstalling and reinstalling that program. If the error code suggests a hardware problem (overheating, bad RAM, or a failing hard drive), you may need to run diagnostics. Windows has a built-in memory diagnostic: press Windows key + R, type "mdsched.exe" without quotes, and press Enter. Restart your computer when prompted.

If you see the same crash repeatedly and cannot fix it yourself, the crash dump file and the Event ID are exactly what support needs. Save a screenshot of the Event Viewer entry or write down the Event ID, error code, and source, then contact the manufacturer or Microsoft support with that information.

Clearing old crash logs when you no longer need them

Event Viewer keeps logs indefinitely unless you clear them. If your System log has thousands of old entries and you want to start fresh, right-click "System" in the left pane and select "Clear Log". Windows will ask you to confirm. You can also export the log first if you want to keep a backup: right-click "System" and select "Save All Events As".

Clearing the log does not affect your computer's performance — it just removes the records. You might want to clear it after you have fixed a problem, so future crashes are easier to spot. Keep in mind that once you clear the log, those old records are gone, so take a screenshot or export the log if you think you might need it later.

Frequently Asked Questions

What does Event ID 1001 mean?

Event ID 1001 is a bugcheck or system crash. It means Windows encountered an error it could not recover from and shut down to prevent damage. The Description field will tell you which driver or component caused it. This is a critical error and usually requires a driver update or hardware check.

Can I see which program crashed if it is not a system error?

System crashes show in Event Viewer under Windows Logs > System. Program crashes (like when a single app stops working) sometimes appear under Applications and Services Logs > process, but not always. If a program crashed, you might see a notification in Windows or a crash report dialog. Check Event Viewer under process first, then look at the program's own error logs if it has them.

What if I see a crash but my computer did not restart?

Not all crashes force a restart. A driver might crash and reload, or a service might fail and restart automatically. These show up in Event Viewer as errors but do not stop your whole system. If you see repeated errors for the same driver or service, update or reinstall it even if your computer is still running.

Do I need to do anything with crash dump files?

Crash dump files are only useful if you are sending them to support or using a debugging tool. You can safely delete them to free up space. Windows stores them in AppData\Local\Temp, so they are not critical system files. If you delete them and another crash happens, Windows will create new ones.

Why does Event Viewer show so many warnings and errors?

Windows logs everything, including minor issues that do not affect you. A single warning or error does not mean your computer is broken. Look for patterns: the same error repeating every day, or errors that happen right before your computer freezes or crashes. Those are the ones worth investigating. One-off warnings can usually be ignored.