memorydump

A memorydump is a snapshot of a computer's volatile memory (RAM) taken at a specific moment. It is used to analyze software crashes, diagnose system faults, conduct memory forensics, and support performance tuning. Memory dumps vary in scope, ranging from a full dump of all physical memory to targeted captures of a single process or a subset of memory such as the kernel or heap.

A memory dump may include code and data pages, stack traces, and the contents of registers, as well as metadata about processes, threads, loaded modules, and memory protection state. In addition to system-wide dumps, there are language- or platform-specific variants such as heap dumps for managed runtimes (for example, Java or .NET) that focus on allocated objects and memory usage rather than the entire process memory.

Creation and formats differ by operating system and toolset. Linux systems generate core dumps for abnormal program termination, with mechanisms like core_pattern and ulimit controlling behavior, and tools such as gcore or debuggers producing dumps. Windows systems create crash dumps that can be full, kernel, or small/minidumps, generated by Windows Error Reporting or third-party tools. Formats include ELF core dumps on Unix-like systems, Windows .dmp files, and various language-specific heap dump formats (such as Java heap dumps). The exact structure and contents depend on the dump type and the capture method.

Uses of memory dumps include post-mortem debugging, reverse engineering, incident response, and performance analysis. They raise privacy and security considerations due to the sensitive data they may contain and can be large, requiring careful handling and storage.