A DMP file is a snapshot of your computer's memory at the moment it crashed

When Windows encounters a serious problem — usually a crash or a "blue screen of death" — it writes a DMP file (short for dump file) to your hard drive. This file contains a record of what your computer's memory looked like at that exact moment: which programs were running, what data they were processing, and where things went wrong. The file itself is not dangerous. It is straightforward evidence of what happened.

You will find DMP files in your Windows folder, typically at C:\Windows\Minidump for smaller crash dumps, or C:\Windows for full memory dumps. The filename usually starts with the date and time of the crash — for example, 010224-1234.dmp means January 2, 2024 at 12:34. Windows creates these files automatically; you do not need to do anything to generate them.

Most people never need to read a DMP file. But if your computer is crashing repeatedly, looking at the DMP file can tell you whether the problem is a failing hard drive, bad RAM, a driver conflict, or a specific program that keeps causing trouble. That information helps you decide whether to update a driver, replace hardware, or uninstall software.

Key Takeaways

  • A DMP file is created automatically when Windows crashes and contains a memory snapshot from that moment.
  • You can view DMP files using the Windows Event Viewer or a free tool like BlueScreenView without installing anything.
  • The most useful information in a DMP file is usually the driver or program name that caused the crash, which tells you what to fix.
  • Deleting old DMP files is safe and frees up disk space, but keeping recent ones helps you spot patterns if crashes keep happening.

Finding your DMP files on your computer

DMP files live in specific Windows folders. The most common location is C:\Windows\Minidump, which holds smaller crash dumps (usually 256 MB or less). If your computer is set to create full memory dumps — a much larger file that captures everything in RAM — that file goes to C:\Windows\MEMORY.DMP.

To navigate there, open File Explorer and type the path directly into the address bar. If you do not see a Minidump folder, your computer may not have crashed yet, or crashes may be set to write full dumps instead. You can also search for *.dmp in File Explorer to find all dump files on your system, regardless of where they are stored.

If you see many DMP files with recent dates, that is a sign your computer is crashing repeatedly — even if you have not noticed the blue screen yourself. Some crashes happen when you are away from the computer, or Windows may restart so quickly you miss the error message.

Reading a DMP file with Event Viewer

The easiest way to read a DMP file is through Event Viewer, a tool built into Windows. Open Event Viewer by pressing Windows key + R, typing eventvwr.msc, and pressing Enter. Navigate to Windows Logs on the left, then click System. Look for entries marked Critical or Error with a red X icon.

Click on a crash entry to see details. The most useful information is usually in the Event ID number and the Details tab. Event ID 1001 means a crash dump was created. In the Details section, look for a line that mentions a driver name (like nvlddmkm.sys for NVIDIA graphics) or a program name. That is usually what caused the crash.

Event Viewer shows you patterns over time. If you see the same driver or program name in multiple crash entries, that is the culprit. If the entries are random and mention different drivers each time, the problem is more likely hardware — a failing hard drive, overheating, or bad RAM.

Using BlueScreenView to see crash details faster

BlueScreenView is a free tool from Nirsoft that reads DMP files and displays the information in a simpler format than Event Viewer. read it from nirsoft.net/utils/bluescreenview.html (no installation needed — just run the .exe file). When you open it, BlueScreenView automatically scans your Minidump folder and lists every crash with the date, time, and the driver or program that caused it.

The advantage of BlueScreenView is speed. You can see at a glance which driver appears in multiple crashes. If you see ntoskrnl.exe (the Windows kernel) listed repeatedly, the problem is likely hardware or a driver conflict. If you see a specific graphics driver, audio driver, or antivirus program, that is your starting point for fixing the issue.

BlueScreenView also shows the Caused By Driver column, which is the single most useful piece of information in a crash dump. Write down that driver name — you will need it to search for updates or to decide whether to uninstall a program.

What the information in a DMP file actually means

A DMP file contains technical data, but you do not need to understand all of it. Focus on three things: the driver or program name, the error code, and the date and time.

The driver name tells you what was running when the crash happened. Common culprits include graphics drivers (names like nvlddmkm.sys for NVIDIA or amdkmdag.sys for AMD), audio drivers, network drivers, or antivirus software. If the same driver appears in multiple crashes, update it or uninstall the program that uses it.

The error code is a hexadecimal number like 0x0000007E or 0x0000001A. You can search this code online to learn what it means, but the driver name is usually more helpful. For example, 0x0000007E means a system thread exception was not handled — but that could be caused by dozens of different drivers, so knowing which driver was running narrows it down.

The date and time help you spot patterns. If crashes happen at the same time every day, something scheduled is running (a backup, an update, a scan). If crashes happen randomly, the problem is more likely hardware or a driver that fails under certain conditions.

Deciding what to do based on what you find

Once you know which driver or program caused the crash, you have a few options. If it is a driver, check the manufacturer's website for an update. For example, if the crash mentions nvlddmkm.sys, visit nvidia.com and read the latest graphics driver for your card. Uninstall the old driver first (use the manufacturer's uninstaller, not just Windows Add/Remove Programs), then install the new one.

If the DMP file mentions an antivirus program, audio software, or other third-party process, try updating it first. If crashes continue, uninstall it and see if the crashes stop. That tells you whether the program is the problem.

If the DMP file mentions ntoskrnl.exe or hal.dll (Windows system files) repeatedly, and no single driver stands out, the problem is likely hardware. Run a hard drive check (right-click your C: drive, select Properties, go to Tools, and click Check) or test your RAM using Windows Memory Diagnostic (search for it in the Start menu). Hardware problems usually require replacement, not software fixes.

Cleaning up old DMP files safely

DMP files take up disk space, especially full memory dumps, which can be several gigabytes. Once you have identified the cause of a crash and fixed it, you can safely delete old DMP files. Keep only the most recent ones (from the last week or two) in case crashes continue and you need to check for new patterns.

To delete DMP files, navigate to C:\Windows\Minidump in File Explorer, select the files you want to remove, and press Delete. You can also delete C:\Windows\MEMORY.DMP if it exists and is very large. Windows will create new DMP files if crashes happen again, so you are not losing anything permanent.

Do not delete DMP files while Windows is actively using them (during or when ready after a crash). If you cannot delete a file, restart your computer and try again.

Frequently Asked Questions

Is it safe to delete DMP files?

Yes. DMP files are just records of past crashes. Deleting them does not affect your computer's ability to run or to create new dumps if crashes happen again. The only reason to keep them is to look for patterns if crashes are ongoing.

Why does my computer keep creating DMP files?

Repeated DMP files mean your computer is crashing repeatedly, usually due to a bad driver, failing hardware, or a program conflict. Use Event Viewer or BlueScreenView to see which driver or program appears in multiple crashes, then update or uninstall it.

What if the DMP file just says ntoskrnl.exe?

That usually means a driver or hardware problem, not Windows itself. Check Event Viewer for more details about what driver was running at the time. If no specific driver stands out, test your RAM and hard drive for hardware failure.

Can I move DMP files to another location?

You can copy them for backup, but Windows expects them in the default locations. Do not move the active MEMORY.DMP file or the Minidump folder itself, as Windows may not find them when the next crash happens.

Do I need special software to read a DMP file?

No. Event Viewer (built into Windows) is enough for most people. BlueScreenView is free and makes it easier, but it is optional. You do not need to buy anything to understand what caused a crash.