Windows NT
A blue screen in Windows NT.
In Windows NT, Windows 2000, Windows XP, Windows Server 2003 and Windows Vista, Blue Screen of Death occurs when the kernel or a driver running in kernel mode, encounters an error which can not be recovered. This is usually caused by an illegal operation being performed. The only security of the operating system can take in this situation is to manually restart the computer. As a result, data may be lost because users were not given the opportunity to save data that has not yet been saved on the hard disk.
The text in the error screen contains the code for the error and its symbolic name (eg “0x0000001E, KMODE EXCEPTION NOT HANDLED”) along with four error codes that depend on the values in parentheses that are there to help software engineers solve the problem occurred. Depending on the error code, you can display the address where the problem occurred, along with the driver that is loaded in that direction. In Windows NT and 2000, the second and third sections of the screen can contain information on all drivers of cargo and a stack dump.
By default, Windows create a memory dump file when a blue screen occurs. Depending on the version of the OS, you can have multiple formats of this, ranging from a 64 KB “mini dump” to a “full dump”, a copy of the entire contents of physical RAM. The memory dump file can be debugged later, using a kernel debugger. A scrubber is necessary to obtain the results of a dump, and it may be necessary to verify the true cause of the problem, as the information onscreen is limited and can therefore hide the true origin of the error.