windows3-6  Exercise 3: Fill In the Crash Log
=================================================================

Verification: Level 1 (run on the author's machine, read-only, no administrator rights).

Prediction (work this out before running the script):

  Before filling it in: list which fields you expect to be able to answer from the logs and which only you can.

Template (use the blank one in the chapter). The author's filled-in version for 2026-10-24:

  CRASH LOG  -  machine: the author's PC   date: 2026-10-24

  1. WHEN
     Kernel-Power 41 logged at 2026-10-24 17:02:57
     Windows' recorded shutdown (6008): 16:50:21
     Gap between the two: 13 minutes (I do not know why: ask the user)

  2. WHAT KIND
     [x] bugcheck: BugcheckCode 314 decimal = 0x13A ; P1 0x11, P2 0xffffb00ee3100140,
         P3 0xffffb00f1e44e350, P4 0x0
     (A second bugcheck, same code and P1, was logged on 2026-10-19 15:38.)

  3. EVIDENCE KEPT
     Dump files: 102426-15109-01.dmp and 101926-16187-01.dmp are in C:\Windows\Minidump; NOT yet copied (needs an
     administrator PowerShell). Event and Reliability CSVs: saved by save_evidence.ps1.

  4. WHAT WAS HAPPENING
     (unknown to me: the user must fill this in)

  5. WHAT CHANGED RECENTLY
     (unknown to me: the user must fill this in; Windows Update history is in Reliability Monitor)

  6. LEADS (not causes)
     - Same bugcheck twice in five days (0x13A, P1 0x11).
     - Stability index fell from 3.843 to 2.807 in the hour of the crash.
     - KAPS.exe (Killer networking service) crashed 6 times in the Reliability Monitor month (13 in the
       Application log) with exception 0xc0000005; a Killer kernel driver is loaded. Whether that links to the
       bugchecks is NOT shown.
     - The two no-stop-code restarts each had a burst of retried I/O on the external USB disks in the 90
       minutes before; the two bugchecks had none.

  7. NEXT STEP, AND HOW TO UNDO IT
     Copy the dumps (administrator PowerShell), then read them (chapter 7). Nothing changes on the PC: no undo needed.

Output:

  (No new command output: this exercise uses the output of crash_timeline.ps1, reliability_summary.ps1 and storage_events.ps1 shown in the chapter.)

WHY THIS WORKS AS AN ANSWER
---------------------------
  Fields the logs can answer: the times, the kind of restart, the stop code and parameters, the dump file name,
  the stability index change, and the storage and application leads. Fields only a person can answer: what was
  happening, what changed recently, and why there was a 13-minute gap; the example marks these as unknown.
  Three leads and what each does not prove: (1) the same bugcheck twice in five days does not prove the same cause;
  (2) KAPS.exe crashing 6 times in the Reliability Monitor month does not show any link to kernel bugchecks, and
  its crashes are not on the bugcheck days; (3) retried I/O before both no-code restarts does not prove
  those drives caused them (retries occur on 25 of 96 days, and there are only two such restarts).
  Common mistakes: writing a cause in the Leads section; leaving unknowns blank instead of marked; and
  forgetting the undo line in the next-step section.