What is a Core Dump?

A core dump is a record of a computer's memory contents when a serious error occurred. It may include the entire system memory or just the portion that was in use by the program which failed. It may also include other relevant data such as the processor state, register contents and information about running processes. Software engineers frequently use core dumps with debuggers and other utilities to analyze and fix computer errors. A core dump can also be used to transfer a working process from one processor to another during normal operation.

The term "core dump" likely originated in the 1960s when early computers used magnetic core memory. When a running program crashed, all of the data in the entire core was printed out on paper to help with debugging. These printouts usually consisted of little more than memory addresses and data in octal or hexadecimal notation. As storage technologies improved, core dumps could be saved to disk, removable magnetic tape or non-volatile memory sticks. Greater storage capacity for state information along with advances in software debugging have made error diagnosis more efficient.

Typical causes of core dumps are poorly-written applications or system software. Quite often, program code assumes that pointers and array indices always reference valid data structures. If any of these have moved beyond the bounds of their original structures, for example, a core dump may occur. Problems accessing data files on a storage device or reading corrupted data may cause a core dump as well. Hardware problems, including malfunctioning memory, hard disks or processors, can also trigger them.

There are generally two types of core dumps. One type is where the running process or application program is terminated and control returns to the operating system. In this case, the rest of the system continues to function normally since only the offending program was stopped. A large core dump file is usually generated which can then be loaded into a debugger. If the error occurred in a program for which the symbols and source code are available, these can be loaded into the debugger as well.

The other more serious type of core dump is also called a kernel panic. This type of dump stops the entire system in its tracks in order to prevent further complications and data corruption. On Microsoft Windows® systems, this kind of dump usually occurs in the all-too-familiar form of a "blue screen of death." Panics like these are usually harder to debug and are often caused by hardware or system-level problems. These can happen before the system has finished booting when little information is available about the actual cause.