Defrag Tools: #9 - ProcDump

In this 3 part episode of Defrag Tools, Andrew Richards and Larry Larsen walk you through Sysinternals ProcDump. ProcDump allows you to capture the memory of a process running on the computer. The dump file can be of varying size and can be taken with varying outage durations. Dumps can be triggered immediately or can be triggered by a variety of events including CPU utilization, Memory utilization, a Performance Counter, a Hung Window and/or Native/Managed exceptions.

Part 1 (this week) covers what the tool captures and the outage durations that can be expected.
Part 2 goes through the wide variety of triggering options; in particular 1st and 2nd chance exceptions.
Part 3 goes through Windows 8 Modern Application support and Process Monitor logging support.

Resources:
Sysinternals ProcDump
Sysinternals VMMap

Timeline:
[01:15] - Download latest version - www.sysinternals.com
[02:23] - ProcDump v5 features
[03:52] - Task Manager, Process Explorer vs. ProcDump
[05:32] - Dump architecture (x86 vs. x64) needs to match the target
[08:02] - Mini, Full (-ma), MiniPlus (-mp) and Custom (-d) dumps
[13:45] - WinDbg - rely on Mapped Memory Image File
[16:54] - ProcDump Custom Dump Support (-d <dll>) - [MSDN Magazine]
[18:34] - Detach at Shutdown, Logoff, Console Close, Ctrl-C, Ctrl-Break
[19:15] - Process Reflection (-r)
[21:44] - Episode review and required permissions
[23:03] - Next episode, triggering...