01.Introduction: What is the Minidump?
When Windows crashes, it dumps the contents of the RAM onto the disk for analysis.
These files are located in C:\Windows\Minidump\.
You cannot open them with Notepad. You need specific tools.
Don't do it Manually.
Voltris Optimizer automates this entire guide and removes Windows delay in seconds.
02.Chapter 1: BlueScreenView (NirSoft)
Fast Analysis
1. Download BlueScreenView (from the NirSoft website). It is portable.
2. Open the program. It lists all recent crashes.
3. Click on the most recent crash (by date).
4. Look at the "Caused By Driver" column.
- If it's nvlddmkm.sys -> Nvidia graphics card.
- If it's atikmdag.sys -> AMD graphics card.
- If it's rtwlanu.sys -> Realtek Wi-Fi driver.
03.Chapter 2: WhoCrashed (For Beginners)
BlueScreenView is technical. WhoCrashed (Resplendence) translates it into simple English.
1. Install it and click "Analyze."
2. It will generate a report: "This was probably caused by the following module: ntoskrnl.exe... Bugcheck code: 0x3B."
3. It suggests generic solutions (Update drivers, check temperature).
04.Chapter 3: The Villain 'ntoskrnl.exe'
Often, the culprit appears as ntoskrnl.exe (Windows Kernel).
This does NOT mean Windows itself is bad. It means "something" caused the Kernel to fail, but the logger didn't catch the specific name.
Usually, ntoskrnl is related to:
- Unstable CPU/RAM overclocking.
- Faulty RAM memory.
- Power supply fluctuations (Low Vcore).
A1.Chapter 4: WinDbg (Professional Analysis)
If the previous steps failed, download WinDbg Preview from the Microsoft Store.
1. File > Open Dump File.
2. Type !analyze -v in the console.
It shows the STACK TEXT (execution stack). You can see exactly what was running just before the crash.
Example: You see "Discord.exe" calling "AudioDevProps.dll" and then CRASH. Thus, the audio driver conflicted with Discord.
A2.Chapter 5: Common Bug Check Codes
- 0x0000001A (MEMORY_MANAGEMENT): Problems with RAM. Run MemTest86 or remove a memory stick. - 0x00000116 (VIDEO_TDR_ERROR): The GPU stopped responding. Usually caused by an aggressive overclock or a corrupted driver. Use DDU. - 0x000000EF (CRITICAL_PROCESS_DIED): Windows lost access to the disk (SSD disconnected/died).
A3.Chapter 6: Configuring Windows to Create Dumps
Sometimes the Minidump folder is empty.
Go to Advanced System Settings > Startup and Recovery.
Under "Write debugging information," select "Small memory dump (256 KB)."
If it's set to "None," Windows won't save the file and you'll never know the cause.
Chapter 7: Driver Verifier (Dangerous)
A Windows tool that stresses all drivers to force a blue screen and reveal the culprit.
Caution: It can put your PC in a boot loop. Only do this if you know how to enter Safe Mode to disable it.
Command: verifier.
Chapter 8: WHEA_UNCORRECTABLE_ERROR
This is a physical HARDWARE error. Not software.
It means the CPU detected an internal voltage or cache error. Remove any Overclock/Undervolt immediately.
Chapter 9: NVMe SSD
Cheap SSDs from certain brands (Kingspec, Goldenfir) often cause random blue screens when they overheat or fail to read. If the code is 0x7A (KERNEL_DATA_INPAGE_ERROR), try changing the SATA cable or the SSD.
Don't do it Manually.
Voltris Optimizer automates this entire guide and removes Windows delay in seconds.
Written by a verified expert
Douglas Felipe M. Gonçalves
Expert in Windows system optimization with years of experience in hardware diagnostics, kernel tuning, and advanced technical support. Founder of Voltris and developer of the Voltris Optimizer.
Meet the Voltris TeamConclusion and Next Steps
By following this guide on Digital Forensics Guide: Diagnosing BSOD, you are equipped with the verified technical knowledge to solve this issue with confidence.
If you still have difficulties after following all steps, our expert support team is available for a personalized remote diagnosis. Every system is unique and may require a specific approach.