TrueCrypt and memory dumps

by jmones

Just a quick note in case it helps anybody: Windows XP won’t generate any memory dumps nor minidumps if system partition is encrypted using TrueCrypt.

As I explained in a previous post, I encrypt my Windows XP installation with a TrueCrypt. Recently I began having strange BSOD and I decided to debug it using memory dump files. Memory dumps are images of the contents of the RAM memory at the moment of the crash. They can be analyzed using appropriate tools to discover the origin of the problem.

After many tries changing the configuration of the memory dump generation function, I tried disabling TrueCrypt and it finally worked.

Later I discovered this is in fact included in TrueCrypt documentation. According to that document, writing memory dumps in an encrypted system partition won’t work in XP/2003, but it will in more recent Windows operating systems, because they lack a needed API.