Analyzing Windows 2000 Memory Dumps

Windows 2000 Memory Dump Options Overview
Microsoft Knowledge Base Article: 254649 - You can configure Windows 2000 to generate any one of the following three dump file types: 

New Crash Dump Options in Windows 2000 Reduce Memory.dmp Size
Microsoft Knowledge Base Article: 228524 - Windows 2000 includes two new options to speed up the time it takes to write the debugging information and limit the disk space needed to store the crash dump file in the event of a fatal error. 

Reading Small Memory Dump Files Created by Windows 2000
Microsoft Knowledge Base Article: 254723 - One of the options for generating dump files in Windows 2000 is the Small Memory Dump (64 KB) option. You can read small memory dump files by using Dumpchk.exe. Information obtained from the dump file can provide a basic starting point for troubleshooting the cause of the problem. 

Savedump.exe Now Provides More Security to Memory.dmp
Microsoft Knowledge Base Article: 173817- Savedump.exe creates a Memory.dmp file with the NTFS permissions inherited from the parent directory. In most cases, this includes the Everyone group with Full Control. 

Support Added to Ntoskrnl.exe and Savedump.exe to Save Mini Dumps
Microsoft Knowledge Base Article: 262077 - Windows 2000 Service Pack 1 (SP1) and Windows 2000 Datacenter Server include the ability for the Windows 2000 kernel and the Savedump.exe tool to extract a mini dump from a full kernel dump. 

Windows 2000 Feature Allows a Memory.dmp File to Be Generated with Keyboard
Microsoft Knowledge Base Article: 244139 - Windows 2000 includes a feature that allows you to crash the system and generate a Memory.dmp file (if configured to do so). The "Stop" screen that is generated contains the following parameters: *** STOP: 0x000000E2 (0x00000000,0x00000000,0x00000000,0x00000000) The end-user manually generated the crashdump.  

Cannot Create a Memory.dmp File on Computers with over 4 GB RAM
Microsoft Knowledge Base Article: 241046 - If your computer contains more than 4 gigabytes (GB) of Random Access Memory (RAM), you may not be able to get a complete memory dump in a Memory.dmp file. 

CPU Context Is Not Saved in the Memorydump File When NMI Occurs
Microsoft Knowledge Base Article: 262686 - When you view the crashdump by using the kernel mode debugger, the processor registers for one more processor on a multiple-processor computer are all zero (0): 1: kd> r eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=00000000 edi=00000000... 

Dump File Not Created Correctly with More Than Four GB of Memory and PAE Turned On
Microsoft Knowledge Base Article: 326333 - If your computer has more than four gigabytes (GB) of memory and Physical Addressing Extensions (PAE) is turned on, dump files may not be created correctly. 

Memory Dump Creation Stops When NMI Occurs
Microsoft Knowledge Base Article: 268378 - Memory dump writing stops when a nonmaskable interrupt (NMI) occurs. This problem is specific to symmetric multiprocessor (SMP) computers. When Windows is writing a memory dump, it usually has a counter on the screen to indicate the progress of the memory dump writing. However, this counter is not displayed at all if this problem occurs. 

Memory Dump May Be Missing or Corrupted on Dynamic Mirrored Drive
Microsoft Knowledge Base Article: 253935 -  When a server stops responding (hangs) at a blue screen, the dump file may be missing or corrupted after you restart the server. Running Dumpchk.exe against the dump file may return the following message: 

Memory Dump Stops When the PAE Option Is Enabled
Microsoft Knowledge Base Article: 266251 - The writing of memory dumps may stop or stall under certain circumstances when the Physical Addressing Extension (PAE) option is enabled. 

Memory.dmp File Is Missing or Contains Corrupted Data
Microsoft Knowledge Base Article: 257299 - If the system partition is built with the dynamic mirrored volume, the Memory.dmp file may not be generated or may contain corrupted data.

Small Memory Dump Does Not Work with PAE Mode Enabled
Microsoft Knowledge Base Article: 260878 - If you start your computer with the /pae switch and the recovery options are set to generate a small memory dump on a system failure, the Minidump.dmp file that is generated may be corrupted.

Windows 2000 Does Not Enable Complete Memory Dumps Between 2 and 4 Gigabytes 
Microsoft Knowledge Base Article: 274598 - Microsoft Windows 2000-based servers do not enable complete memory dumps that are between 2 and 4 gigabytes (GB) in size. The only options available under the Write Debugging Information section are: Small Memory Dump (64 KB) and Kernel Memory Dump. The Complete Memory Dump option is missing 

Windows Does Not Save Memory Dump File After a Crash 
Microsoft Knowledge Base Article: 130536 - You can configure Windows to dump system memory to a file called Memory.dmp when a severe error (called a STOP error or fatal system error) occurs. This log file can be valuable for debugging the cause of the STOP error.