Analysisng Dump Files - identifying problem drivers

Question

Hi All,

I have searched the net for answers on how to analyse dump files and come up with lots of answers but none provide any understanding. I'm using WinDbg to analyse by dump files using the windows symbol server and I have also download symbols from the relevant site. This has been working well for me but I require further understanding on how to identify the problem driver from the txt, code etc to resolve the issue. Can one help me please? Your assistance would be greatly appreciated.

Thanks,

Ben

Answer 1

Glad to see you John.  +1

Answer 2

Just thought that I'd jump in here with my opinion.

I have information on how to analyze BSOD's located here:  http://www.carrona.org/bsod.html .  Not just the memory dump analysis - but other steps that help to solve these problems.  I hope to have another version of the "How To" link updated in the near future.

As ZigZag states, older drivers aren't simply a problem because they're old.  The age is only  a hint that there may be problems with it.  For example, if a driver dates from before the OS was released, there's a greater chance that it might not be compatible with the OS.

Just FYI - here's how I do BSOD analysis':

• first I rule out 3rd party drivers (over 90% of BSOD's are due to this)
• then I rule out hardware (less than 10% of BSOD's are due to this)
• then I look at Windows problems (less than 1% of BSOD's are due to this - as long as Windows Updates are fully up to date).

I presume that the system is up to date with Windows Updates - and request that the owner ensure that this is done (we get the update info from the systeminfo.exe report)

Once that's done, I look for known problems in the systeminfo.exe report and the MSINFO32 report

Then I look at the dump files. 

I look for known problems and patterns in the dump files (that's why I want to go over all the memory dumps).  Then I look for the older drivers.

Once I run out of 3rd party drivers to pick on - then we must either go to Driver Verifier or to hardware diagnostics.  I save the reinstall of Windows to last - although it may be more convenient for the owner to do it after the 3rd party drivers and before the hardware testing.

Good luck!

Answer 3

Ben

I merged your post on the other thread with this one to avoid confusion.

Answer 4

Ben

There is no simple way to explain (especially in this format).  If you upload the DMP files and your analysis I can tell give you some pointers but Analyzing DMP files is as much art as science and there is not substitute for practice.

EDIT:: To add from your other thread

Old drivers are generally considered to be drivers that were dated before the OS came out.  For win 7 it was July 13, 2009, with SP-1 being newer.

Answer 5

Hi ZigZag,

I was just searching the net for information about analysing dump files and came across this post, apologise for jumping on the band wagon so to speak. I just have one question really how do you find what "old drivers" could potential cause the issue from the stack of txt in the dump file?

I'm currently having issues and I don't understand how you can identify the driver.  your assistance would be greatly appreciated.

Thanks, Ben