The short answer: A blue screen means the Windows kernel ran into an error it cannot safely survive, so it stopped instead — and the stop code on screen tells you why. A one-off crash after a driver update is usually nothing. Repeated crashes, however, especially with codes like KERNEL_DATA_INPAGE_ERROR, INACCESSIBLE_BOOT_DEVICE, NTFS_FILE_SYSTEM or UNEXPECTED_STORE_EXCEPTION, often point to a failing drive. When that happens, don’t run CHKDSK over and over, don’t let automatic repairs loop, and stop worrying about Windows — worry about your data: check SMART, and if the drive shows bad sectors or makes noises, shut the computer down and have it diagnosed.
The blue screen has a reputation as a disaster, but on its own it isn’t one. It’s a safety catch: Windows detected that something in the kernel could corrupt data in memory or on disk, and it stopped before that happened. The disaster starts later — when the crashes keep coming, the user „fixes" them by rebooting and reinstalling, and misses the fact that the real cause is a dying drive holding the only copy of the family photos or the company books. This article explains what stop codes mean, how to tell memory, drivers and drive failure apart, and when to stop experimenting.
What actually happened during a blue screen
The Windows kernel runs with the highest privileges, and an error inside it can’t be caught the way an ordinary program crash can. When a driver reaches into memory it has no business touching, when a page of swapped-out memory can’t be read back from the drive, or when hardware reports an uncorrectable error, the system raises what’s called a stop error: it halts everything, prints a stop code and saves a memory dump for later analysis. Then it restarts.
Two practical notes about the screen itself:
- It doesn’t have to be blue. Microsoft redesigned it during 2025: newer Windows 11 builds show a black, terser version instead of the classic blue screen — no sad face, no QR code. The essentials remain: at the bottom you’ll find the stop code and sometimes the name of the file that caused the crash (typically a driver with the
.sysextension). Windows 10 and older Windows 11 builds still show the blue variant, so nowadays the colour says more about your Windows version than about the type of fault. - Photograph the stop code. It disappears after the restart, and diagnosing without it is considerably harder. A phone snapshot is enough.
Windows also saves what’s called a minidump — a small snapshot of the kernel’s state at the moment of the crash — into the C:\Windows\Minidump folder. We’ll come back to it, because it’s the most valuable trace a blue screen leaves behind.
The most common stop codes and what they usually mean
A stop code isn’t a verdict, it’s a signpost. The same code can have several causes, but it still pays to know the usual suspects:
| Stop code | Most likely direction |
|---|---|
| MEMORY_MANAGEMENT | System memory (RAM), less often a driver |
| PAGE_FAULT_IN_NONPAGED_AREA | RAM, a faulty driver, antivirus |
| IRQL_NOT_LESS_OR_EQUAL | A driver reaching into someone else’s memory, RAM |
| SYSTEM_SERVICE_EXCEPTION | A driver or a corrupted system file |
| VIDEO_TDR_FAILURE | Graphics driver (GPU timeout) |
| DPC_WATCHDOG_VIOLATION | Storage driver, SSD firmware, a stuck driver |
| WHEA_UNCORRECTABLE_ERROR | Hardware — CPU, power supply, overclocking, firmware |
| KERNEL_DATA_INPAGE_ERROR | Data couldn’t be read from the drive — bad sectors, cabling, controller |
| INACCESSIBLE_BOOT_DEVICE | The system lost the boot drive at startup — storage driver, a changed mode in the BIOS, a failing drive |
| NTFS_FILE_SYSTEM | A damaged file system, often a consequence of bad sectors |
| UNEXPECTED_STORE_EXCEPTION | An error reading compressed memory — a frequent companion of a failing SSD |
| CRITICAL_PROCESS_DIED | A critical process died — anywhere from drivers to corrupted system files on a bad drive |
The top half of the table points towards memory and drivers. The bottom half is where you should prick up your ears: storage is in play in every one of those.
How to tell RAM, drivers and the drive apart
Before you reinstall anything, ask yourself three questions.
When did it first happen and what changed at the time? A blue screen a day after installing a new graphics card, updating a driver or running a major Windows update points to software and drivers. A crash „out of nowhere" on a machine where nothing has changed for a year points more towards hardware — and on an older machine, towards the drive or the RAM. A special case these days are machines freshly moved to Windows 11: mainstream support for Windows 10 ended on 14 October 2025, and since then people have been upgrading hardware with five or more years of service behind it. After such a move, both problems often arrive at once — new drivers on old components plus a worn-out drive — which is all the more reason to look at SMART first and only then at the system.
Does it repeat during the same activity? Crashes in games and demanding graphics work point to the GPU and its driver, or to overheating. Crashes while copying large files, while working with a particular folder, or at random while the machine is idle point to the drive. Completely random crashes with no pattern, occasionally accompanied by freezes or spontaneous restarts, tend to be RAM or the power supply.
What does the system itself say? Open Event Viewer, the System log, and go through the entries from around the time of the crashes. You’re mainly looking for errors with the source disk or Ntfs — messages about a bad block or repeated read operations are a practically unambiguous pointer at storage. Errors from the Kernel-Power source only state that the computer shut down incorrectly; on their own they say nothing about the cause.
Add two quick checks, both free:
- RAM: run
mdsched.exe(Windows Memory Diagnostic) — it runs during the restart. A more thorough option is a bootable MemTest86 from a USB stick; let it run several passes, memory errors like to hide. A single error found means a faulty module. - Drive: install CrystalDiskInfo and look at SMART. Non-zero Reallocated, Pending or Uncorrectable sector counts on a drive throwing blue screens change the situation from „repairing Windows„ to „rescuing data". Exactly what the individual attributes mean and which values are still tolerable is covered in the article on how to tell that an HDD or SSD is dying.
When the drive is behind the blue screen — and what not to do then
A dying drive rarely announces itself with a blue screen alone. The typical picture is a combination: a BSOD with one of the codes from the bottom half of the table, plus files taking forever to load, File Explorer freezing on particular folders, and on a mechanical drive the occasional clicking or repeated spin-up. Sometimes the system ends up in an „Automatic Repair" loop after a crash and won’t start at all — because the repair needs to read from places the drive can no longer read. If the drive is making noises, the same rules apply as with any mechanical fault — they’re described in the article on what to do when a drive is clicking.
There’s a practical difference between a platter drive and an SSD that’s worth knowing. An HDD fails gradually and loudly: reads slow down, reallocated and pending sectors pile up, clicking starts — there’s usually a whole series of warning signs and, with them, some time to make a backup. You can’t hear an SSD, and its degradation is masked for a long time by the controller’s error correction; then comes the break — the drive switches to read-only mode, vanishes from the BIOS or starts returning corrupted data. So don’t take blue screens with UNEXPECTED_STORE_EXCEPTION or CRITICAL_PROCESS_DIED on an SSD lightly: the gap between the first symptom and an unreadable drive is usually shorter than with a mechanical one.
In this situation, the well-meant effort to „repair" the system does the most damage:
- Don’t run CHKDSK /r repeatedly, and don’t let automatic repairs loop. Repairing the file system means hours of intensive reading and writing on a drive that’s failing. Pending sectors turn into unreadable ones, and data that could still be copied yesterday disappears. Exactly why this does harm is covered in the article on bad sectors on a drive.
- Don’t reinstall Windows. The installation writes across the entire system partition. If the drive holds the only copy of important data, reinstalling without a backup first is an irreversible step.
- Don’t reset the computer „to factory settings". Same problem, same outcome.
- Don’t work around the problem with endless restarts. Every startup of a failing drive is extra strain.
Newer Windows 11 versions also handle this situation on their own: when startup fails repeatedly, they can boot into the recovery environment, connect to the network and download a fix from Microsoft. Against a broadly deployed faulty update that’s good news — the computer repairs itself without the user lifting a finger. With a failing drive, though, the same thing applies as with a manual repair: every further attempt is another read from media that reads worse and worse. If SMART reports a problem, don’t let the automation keep looping — shut the computer down.
The correct order is the reverse: data first, system second. If the drive still reads and the data on it has value, copy the most important things onto other media now — not after the weekend. If it no longer reads, reports bad sectors or makes noises, shut the computer down and have the storage assessed professionally. Drive diagnostics as part of data recovery is free and without obligation with us — you’ll learn what type of fault it is and what the realistic chances are before you decide whether to order the recovery.
How to read a minidump without being a developer
The minidumps in C:\Windows\Minidump are binary files and Notepad won’t help you with them. Two workable routes:
WinDbg (free from the Microsoft Store): open the minidump file and enter the command !analyze -v. The output is long, but you’re looking for two things — the stop code with its parameters, and the line naming the module the analysis flagged as the likely culprit. If the same third-party driver keeps showing up there (graphics, antivirus, VPN, a laptop vendor’s utility), you have your suspect.
BlueScreenView (NirSoft, free): a simpler overview of all crashes in a table, including highlighted modules. Good enough for a quick orientation.
One warning that trips up a lot of people: if the analysis points at ntoskrnl.exe or another file belonging to the kernel itself, it does not mean „the Windows kernel is broken". The kernel is usually the victim, not the perpetrator — the real cause is typically faulty RAM, a driver that corrupted someone else’s memory, or the very drive that handed the kernel corrupted data. That’s why you should never read a minidump in isolation, but always alongside SMART and the system log.
What you can safely try at home
If SMART is clean, the drive makes no noises and there are no storage errors in the log, it’s safe to work your way up from the software:
- Undo the last change. Uninstall the update, driver or program installed just before the first crashes; with a graphics driver, a clean install of an older stable version helps.
- Disconnect peripherals. Docking stations, USB devices, card readers — a faulty device or its driver can bring down the whole system.
- Check temperatures and accumulated dust. Overheating shows up as crashes under load; on a laptop, a clogged cooler is usually to blame.
- Test the RAM with MemTest86, ideally one module at a time so you identify the faulty stick directly.
- On a desktop, check the drive cables. A badly seated SATA cable can produce KERNEL_DATA_INPAGE_ERROR even on a healthy drive.
And one trap to finish with: if, after repair work — a BIOS update, a Secure Boot change, a bootloader repair — the computer shows a blue screen asking for a 48-digit key instead of starting Windows, that’s not another fault. It’s BitLocker and its protective reaction to a configuration change; where to find the key is described in the article on BitLocker suddenly asking for the recovery key after a Windows update.
When to stop dealing with it at home
Home diagnostics has a sensible limit. It makes sense to stop experimenting and hand the machine over when:
- the crashes continue even after testing the RAM and undoing software changes;
- the stop codes point at storage, SMART isn’t clean, or the system won’t start at all;
- suspicion falls on the motherboard or the power supply — you can’t verify that at home without spare parts;
- the drive holds data you don’t want to lose, and every further attempt is a risk.
For pinpointing the culprit we offer hardware problem diagnostics — we go through the minidumps and logs, test the memory, the drive and the power supply on our own equipment, and tell you which component is causing the crashes and what to do about it. That’s a substantial difference from a blanket reinstall: it won’t help with a hardware cause, and with a failing drive it does harm.
Frequently asked questions
Is every blue screen a reason to panic?
No. One crash a year, typically after a driver update, is noise — note down the stop code and watch whether it comes back. What warrants action is repetition, any kind of pattern (same activity, same code) and a combination with other symptoms, above all slow file reads.
Will reinstalling Windows help?
Only if the cause is software — a corrupted system, mangled drivers. With faulty RAM, a bad drive or a failing power supply the crashes will come back sooner or later, and with a failing drive a reinstall also endangers whatever data remains on it. That’s why diagnosis should come before the reinstall, not the other way round.
The blue screen points at ntoskrnl.exe. What does that mean?
Almost never that the Windows kernel is faulty. The kernel merely reported the crash; the real culprit is usually faulty memory, a third-party driver or a drive that returned corrupted data. Treat it as an instruction to test the RAM and check SMART, not as a reason to reinstall the system.
Why is the new screen black instead of blue?
Because Microsoft redesigned it in 2025 — newer Windows 11 reports the stop error on a black background, more tersely and without a QR code. It has no bearing on the cause or the procedure: the stop code and the name of the failing file remain on screen, and the diagnostics are done exactly the same way.
How do I tell it’s the drive and not the RAM?
The drive gives itself away through stop codes like KERNEL_DATA_INPAGE_ERROR, INACCESSIBLE_BOOT_DEVICE or NTFS_FILE_SYSTEM, „disk" source errors in Event Viewer, non-zero Pending or Reallocated sector counts in SMART, and crashes tied to working with files. RAM shows up randomly, with no link to the drive, and MemTest86 will expose it.
Can a blue screen cost me my data?
Because of the crash itself, usually not — at most unsaved files. The risk arises when the cause is a failing drive and the repairs continue while it’s running: CHKDSK, resets, reinstalls. If SMART reports bad sectors and the data has value, the drive belongs on the diagnostic bench and on a backup first, and only then in a system repair.