Blue Screen of Death (BSOD) Viewer: How to Read Crash Dumps

A blue screen viewer is a tool that opens the crash dump files Windows saves after a Blue Screen of Death (BSOD) and shows you the stop code and the driver or file that was running when the crash happened. Microsoft's own option is WinDbg, a free debugger from the Microsoft Store; simpler third-party viewers exist too. Reading the dump turns a vague "my PC crashed" into a specific suspect you can update, roll back or remove.

This guide shows where the dump files live, how to make sure Windows creates them, and how to read them with WinDbg, Event Viewer and Reliability Monitor.

What Does a Blue Screen Viewer Actually Show You?

A blue screen viewer shows the stop code, the parameters Windows recorded, and the module (usually a driver file ending in .sys) that was executing at the moment of the crash. That module is your best lead, though not necessarily the final answer.

When Windows hits a problem it cannot safely recover from, it halts, displays a stop code such as PAGE_FAULT_IN_NONPAGED_AREA or MEMORY_MANAGEMENT, writes the contents of memory to a dump file, and restarts. Microsoft calls this a stop code error, bug check or kernel error. On Windows 11 version 24H2 and later the screen looks different from the classic blue design, and Microsoft's documentation now refers to blue and black stop screens together, but the dump files work the same way.

The reason a viewer helps is timing. The stop screen often disappears in seconds, and the restart wipes the details. The dump file keeps them.

Where Are BSOD Crash Dump Files Stored?

Windows stores small crash dumps in C:\Windows\Minidump and the larger automatic or kernel dump in C:\Windows\MEMORY.DMP. Each minidump file name includes the date, so you can match it to the time of a crash.

Both folders are protected, so you need administrator rights to open them. Copying the newest .dmp file to your desktop first avoids permission errors in some viewers.

How Do You Make Sure Windows Saves Crash Dumps?

Windows saves an automatic memory dump by default, but cleanup tools, a tiny page file or changed settings can stop dumps being written. Check the setting before the next crash so you have something to read.

1. Open Settings → System → About and select Advanced system settings.
2. On the Advanced tab, under Startup and Recovery, select Settings.
3. Under Write debugging information, choose Automatic memory dump or Small memory dump.
4. Confirm the small dump directory reads %SystemRoot%\Minidump, then select OK.
5. Make sure the system drive has free space and that a page file exists, because Windows writes the dump through the page file first.

That last point is a cause-and-effect trap: if you disabled the page file to save space, Windows has nowhere to stage the dump, and the crash leaves no evidence behind.

How to Read a Crash Dump with WinDbg

WinDbg is Microsoft's free debugger, and its !analyze -v command produces the most reliable crash summary available. It looks intimidating, but for a basic diagnosis you only need a few steps.

1. Install WinDbg from the Microsoft Store, or open Terminal and run winget install Microsoft.WinDbg.
2. Right-click WinDbg and choose Run as administrator.
3. Select File → Open dump file, browse to C:\Windows\Minidump (or your desktop copy), and open the newest .dmp file.
4. Wait while WinDbg loads symbols from Microsoft's public symbol server. This needs internet access and can take a minute the first time.
5. In the command box, type !analyze -v and press Enter.
6. Read the lines labelled BUGCHECK_CODE, MODULE_NAME, IMAGE_NAME and PROCESS_NAME.

If IMAGE_NAME points to a third-party driver, such as a graphics, network, audio or antivirus driver, that driver is your prime suspect. If it points to a core Windows file such as ntoskrnl.exe, the real cause is usually elsewhere: faulty RAM, a failing drive or a driver that corrupted memory earlier. In that case, compare several dumps and look for a pattern.

Are There Simpler Blue Screen Readers?

Yes. Free third-party utilities, the best known being NirSoft's BlueScreenView, list every minidump in a table and highlight the drivers found in each crash. They are quicker to scan than WinDbg but show less detail and are not Microsoft software.

If you use one, download it only from the developer's own website and scan it with Windows Security first. Avoid "driver fixer" or "PC repair" bundles that claim to read blue screens and then push paid licences.

Windows also has two built-in viewers that need nothing installed:

• Reliability Monitor: press Windows + R, type perfmon /rel and press Enter. Red crosses mark critical events, and each crash shows its bug check code alongside the apps and updates installed that day.
• Event Viewer: open Event Viewer → Windows Logs → System and filter for BugCheck as the source to see each crash with its code and dump file path.

Reliability Monitor is especially useful for spotting cause and effect, such as crashes that start the day a new driver or update was installed.

What to Do After You Find the Cause

Once you have a suspect, fix the cause rather than the symptom. Microsoft's own blue screen troubleshooting guide recommends the same order:

1. Remove any hardware you added just before the crashes started.
2. Update, roll back or uninstall the driver named in the dump through Device Manager.
3. Install the latest updates from Settings → Windows Update.
4. Keep 10–15% of the system drive free.
5. Repair damaged system files with DISM RestoreHealth and SFC.
6. If crashes continue, try a Windows 11 repair install, which replaces system files but keeps your apps and data.

If the crashes happen even in Safe Mode, suspect hardware: run Windows Memory Diagnostic and check the drive's health tools from the manufacturer.

A Common Mistake We See

The most common mistake is reinstalling Windows straight away after a blue screen. If the cause is a manufacturer driver, such as one from an HP or Toshiba support utility, the same driver gets reinstalled afterwards and the crashes come back. Reading the dump first takes ten minutes and tells you which component to deal with.

If you do end up needing a fresh start, read clean install vs reset first so you pick the least disruptive option. A digital licence reactivates automatically after reinstalling the same edition on the same hardware, and our support team can help if activation needs attention afterwards.

Frequently Asked Questions

What is the best blue screen viewer for Windows 11?

WinDbg is the most accurate because it is Microsoft's own debugger and its !analyze -v command interprets the dump with official symbols. Third-party blue screen readers are quicker for a first look at several crashes. Reliability Monitor is the easiest built-in option if you only need the dates and stop codes.

How do I use a blue screen view tool if my PC won't start?

Start Windows in Safe Mode, or boot from another PC's USB installer and copy C:\Windows\Minidump to a USB stick. You can then open the dump files with WinDbg on a working computer, because a dump file can be analysed on any Windows PC.

Why is there no Minidump folder on my PC?

Either no crash has written a dump yet, or dump creation is disabled. Check Startup and Recovery settings, make sure a page file exists and free some disk space. Some cleanup tools also delete old dump files automatically.

My PC screen is blue but there is no error code. What does that mean?

A plain blue or black screen without a stop code is usually a display, driver or sign-in issue rather than a bug check, so no dump is written. Try Windows + Ctrl + Shift + B to restart the graphics driver, then check your display cable and graphics driver.

Why does my HP laptop keep getting the blue screen of death?

On branded laptops, repeated crashes usually trace back to a specific driver, BIOS version or overheating rather than the brand itself. Read the dump to find the module, then install that driver and the latest BIOS from the manufacturer's support page. Clean the vents if crashes happen under load.

Can a blue screen be caused by an activation problem?

No. An unactivated or wrongly activated copy of Windows shows watermarks and limits personalisation, but it does not trigger stop codes. Crashes come from drivers, hardware, corrupted system files or low-level software such as antivirus and disk tools.

Conclusion

A blue screen viewer turns a crash into evidence: the stop code tells you what failed and the module tells you where to look. Use WinDbg for accuracy, Reliability Monitor for patterns, and fix the named driver or hardware before reinstalling anything. If you are rebuilding a PC on a supported system, our Windows 11 licences include instant email delivery and a lifetime replacement warranty.

Useful Links