Registry Location of System Crash Dump Filters

This article explains the exact location where the Windows Registry Editor (Regedit) stores the list of registered system crash dump filter drivers. It details the specific registry path, the value name used by Windows, its data type, and how these filter drivers function during a kernel crash or system dump creation.

Exact Registry Path

The list of registered system crash dump filters is located in the following registry path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl

Registry Value Details

Within the CrashControl key, dump filters are recorded under the following value:

• Value Name: DumpFilters
• Data Type: REG_MULTI_SZ (Multi-String Value)
• Value Data: A list of driver filenames (e.g., dumpfve.sys)

Purpose of Crash Dump Filters

Crash dump filter drivers are specialized drivers loaded by the Windows kernel during a system crash (Bug Check / Blue Screen of Death). When the system writes the memory dump to the disk:

1. Storage and Encryption: Filter drivers modify the dump write process. A common default entry is dumpfve.sys, which represents the BitLocker Drive Encryption Dump Filter used to encrypt the dump file on encrypted volumes.
2. Third-Party Utilities: Specialized software, such as monitoring tools, custom storage controllers, or third-party encryption programs, may add custom filter drivers to this list.

How to View the Setting in Regedit

1. Press Win + R, type regedit, and press Enter.
2. Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
3. Locate the DumpFilters entry in the right pane.
4. Double-click DumpFilters to view or modify the installed crash dump filter driver names.