Solved

Extract data from user.dmp?

Posted on 2003-11-01
9
201 Views
Last Modified: 2010-04-13
I was using a tv capture application called WinTV from Hauppage.
When you press the "capture" button in WinTV, a picture is being saved in Windows memory. After that you can choose to save this file to the harddrive and delete the original from the memory.
I had made some - well, a _lot_ - captures with this application when it suddenly crashed and I hadn't saved these captures to files on the harddrive.
When it crashed this DrWatson thing was run.
I now have a 73 MB user.dmp file in my DrWatson folder. I don't know the size of this file before the crash.
Now my hope is that there is a way to extract these pictures from the user.dmp.
Is there a way?
0
Comment
Question by:CVic
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
9 Comments
 
LVL 44

Expert Comment

by:CrazyOne
ID: 9664929
Not that I am aware of but it would be interesting if someone knew how.
0
 
LVL 44

Expert Comment

by:CrazyOne
ID: 9664933
A lot of programs create at tmp files perhaps you could see it this one did

Look in C:\Documents and Settings\YourProfile\Local Settings\Temp
0
Optimize your web performance

What's in the eBook?
- Full list of reasons for poor performance
- Ultimate measures to speed things up
- Primary web monitoring types
- KPIs you should be monitoring in order to increase your ROI

 
LVL 49

Expert Comment

by:sunray_2003
ID: 9665614
try downloading this tool and check


http://www.microsoft.com/whdc/ddk/debugging/default.mspx

S
0
 

Author Comment

by:CVic
ID: 9665864
First of all, when data is stored in system memory and the application that helds the data crash, is really all that data dumped to USER.DMP? Or is only *information* about the crash being appended to the file?

Is 73 MB a normal size of a USER.DMP file? Because there was a lot of picture data in system memory when WinTV crashed, like 100-150 pictures in 640x480 with no compression.

CrazyOne: I've checked for that, but no, there is no such tmp file. :-/

Stoner79: Doesn't look like this program actually can *view* the dump file? It can only check information of recent crashes, right?. But as I said, maybe the data (pictures) that was stored in system memory actually wasn't dumped to the file... If so, there's nothing I can do but give up...

sunray_2003: Same here - I don't think this program actually can view eventually data from the file...?


Before WinTV crashed, my allocating memory was at around 800 000 kb, after it terminated it was at around 500 000 kb (yes, I have a lot of applications/windows open at the moment :-) )
So the data was realased from memory, or it was stored in USER.DMP...

Argh, I really want to get back those unsaved pictures :-( But it seems like they're gone forever...
0
 
LVL 44

Expert Comment

by:CrazyOne
ID: 9665964
Unfortunately I think they are gone forever. It depends how the system is setup to do memory dump. It looks like yours is setup for a small memory dump based on the size of this file. If it was setup for a large memory dump then the entire contents of the memory would have been dumped and the file would be much larger then 73MB's. I got to think that those captures were more than 73MB's.
0
 

Accepted Solution

by:
PashaMod earned 0 total points
ID: 10091155
PAQed - no points refunded (of 500)

PashaMod
Community Support Moderator
0

Featured Post

Ransomware: The New Cyber Threat & How to Stop It

This infographic explains ransomware, type of malware that blocks access to your files or your systems and holds them hostage until a ransom is paid. It also examines the different types of ransomware and explains what you can do to thwart this sinister online threat.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Let's recap what we learned from yesterday's Skyport Systems webinar.
Add bar graphs to Access queries using Unicode block characters. Graphs appear on every record in the color you want. Give life to numbers. Hopes this gives you ideas on visualizing your data in new ways ~ Create a calculated field in a query: …
Visualize your data even better in Access queries. Given a date and a value, this lesson shows how to compare that value with the previous value, calculate the difference, and display a circle if the value is the same, an up triangle if it increased…

628 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question