A single blue screen can leave a file the size of your RAM
Windows writes a memory dump when it crashes, and the default setting can produce an enormous one. Where they are and what to keep.
After a blue screen, Windows writes what was in memory to disk so the crash can be diagnosed. Depending on one setting, that file is either a few hundred kilobytes or the size of your installed memory.
The three kinds
| Kind | Where | Size |
|---|---|---|
| Complete memory dump | C:\Windows\memory.dmp | As large as your RAM |
| Kernel memory dump | C:\Windows\memory.dmp | Hundreds of MB to a few GB |
| Small memory dump | C:\Windows\Minidump | A few hundred KB each |
| Live kernel reports | C:\Windows\LiveKernelReports | Hundreds of MB, and they accumulate |
| Application crash dumps | %LOCALAPPDATA%\CrashDumps | Per crash, per application |
Finding them
Get-Item C:\Windows\memory.dmp -Force -EA SilentlyContinue |
Select-Object @{n='GB';e={[math]::Round($_.Length/1GB,2)}}, LastWriteTime
Get-ChildItem C:\Windows\Minidump, C:\Windows\LiveKernelReports, $env:LOCALAPPDATA\CrashDumps -Force -EA SilentlyContinue |
Measure-Object Length -Sum | Select-Object Count, @{n='MB';e={[math]::Round($_.Sum/1MB)}}Changing what gets written
The setting is in System Properties, Advanced, Startup and Recovery. Small memory dump is enough to identify a faulting driver in most cases and costs kilobytes. Complete memory dump is what produces a file the size of your RAM and is only useful if somebody is going to analyse it properly.
What is safe to remove
- Old minidumps, once whatever crashed has been fixed. They are small anyway.
- memory.dmp, if you are not sending it to anyone. Disk Cleanup lists it as System error memory dump files.
- LiveKernelReports, which accumulate from non fatal driver faults and are rarely looked at.
- Application crash dumps in AppData, which belong to programs that have already crashed and restarted.
When to keep one
If the machine is crashing repeatedly, the dump is the only record of why. Keep the most recent, fix the cause, and clear them afterwards. Removing them while the problem is live means the next person to look has nothing to work with.
Disk Cleanup's system files mode lists most of these as categories, which is covered in Disk Cleanup against Storage Sense.
Common questions
What is memory.dmp and can I delete it?
It is the memory dump Windows writes after a blue screen, sized according to the dump setting, and a complete dump is as large as your RAM. It is safe to delete once you are not diagnosing the crash.
Where are crash dumps stored on Windows?
C:\Windows\memory.dmp for the full dump, C:\Windows\Minidump for small ones, C:\Windows\LiveKernelReports for non fatal driver faults, and %LOCALAPPDATA%\CrashDumps for application crashes.
How do I stop Windows writing huge dump files?
In System Properties, Advanced, Startup and Recovery, set the dump type to Small memory dump. It is enough to identify a faulting driver and costs kilobytes instead of gigabytes.
What is the LiveKernelReports folder?
Reports from driver faults that did not crash the machine. They accumulate quietly, are rarely analysed by anyone, and are safe to clear.