Hi,

Nice article, but it's worth to mention that it won't work with different paging files spread around different partitions. Unless you have enough free space on c:\ the dumps will be corrupt. We had it a lot of times and did multiple investigations - dumps will be actually cached on first paging file (on drive c: usually) before they will get copied to the other paging files.

So either you make your first paging file large enough, or you won't get a dump that can be fully analyzed.

In case you don't have enough space left, you should rather go for a "kernel memory dump" which fits the needs for analysis in about 98% of all cases. (Actually a bluescreen can happens in the priviledged kernel mode, this the inital stacktrace/trigger will always be visible in the kernel dump, the further analysis however can get stuck at a certain point as user memory is missing)

regards

Andreas