.bugcheck (Display Bug Check Data)

The .bugcheck command displays the data from a bug check on the target computer.




kernel mode only


live, crash dump



Additional Information

For more information about bug checks, see Bug Checks (Blue Screens). For a description of individual bug checks, see the Bug Check Code Reference section.


This command displays the current bug check data. (This bug check data will be accessible until the crashed machine is rebooted.)

You can also display bug check data on 32-bit systems by using dd NT!KiBugCheckData L5, or on 64-bit systems by using dq NT!KiBugCheckData L5. However, the .bugcheck command is more reliable, because it works in some scenarios that the d* (Display Memory) command will not (such as user-mode minidumps).

The !analyze extension command is also useful after a bug check occurs.