CrashWhyWhere are crash logs in Windows 11, and how do I read them?
Windows 11 keeps crash records in two places: the System log in Event Viewer, which records every crash, restart and unexpected shutdown, and memory dump files — small dumps in %SystemRoot%\Minidump (usually C:\Windows\Minidump) and a larger dump at %SystemRoot%\MEMORY.DMP — which exist only after a blue screen.
1. The System log (every crash and restart)
Open Event Viewer (Win + R, eventvwr.msc) → Windows Logs → System, then Filter Current Log… by event ID. These are the ones that matter:
| Event ID | Source | What it records |
|---|---|---|
| 41 | Kernel-Power | Windows restarted without shutting down cleanly. Its BugcheckCode value says whether a Stop error was behind it. |
| 6008 | EventLog | The previous shutdown was unexpected, with its time. |
| 1001 | BugCheck | The PC rebooted from a blue screen: the bug check code and where the dump file was saved. |
| 1074 | User32 | A program or user asked for a shutdown or restart — with the process name and the reason. |
| 6006 | EventLog | Windows shut down cleanly. |
To look at a time window instead of one event, Windows also has Reliability Monitor: press Win + R and run perfmon /rel. It shows crashes and failed updates day by day.
2. Memory dump files (blue screens only)
- Small memory dumps:
%SystemRoot%\Minidump. Windows keeps one date-named file per crash, so you get a history. - Kernel or complete dump:
%SystemRoot%\MEMORY.DMP. With the default setting, the next crash overwrites it. - No dump at all usually means the PC did not blue-screen — it lost power or hung. Windows also needs a page file on the boot drive to write a dump.
You can change the dump type in System Properties → Advanced → Startup and Recovery → Settings → Write debugging information.
3. Read a dump file
- Install WinDbg (Microsoft's Windows Debugger) from the Debugging Tools for Windows page.
- Open WinDbg, use the File menu to open a dump file, and pick one from
C:\Windows\Minidump. - Run
!analyze -v. It shows the bug check code, its parameters and the module (often a driver) that was running. - Look up the bug check code in Microsoft's Bug Check Code Reference.
Where is the blue screen log in Windows 11?
The record of the blue screen is Event 1001 (source BugCheck) in Event Viewer's System log, and the details are in the dump file it names, usually in C:\Windows\Minidump.
Why is my Minidump folder empty?
Dumps are written only for Stop errors. If the PC shut off or restarted without a blue screen, there is no dump — check Event 41 and 6008 instead. Dumps also need a page file on the boot drive, and cleanup tools sometimes delete them.
Sources
Official documentation, checked 2026-10-16.
CrashWhy reads these Windows logs for you and explains what happened in plain English — free for Windows.