How can I check what time was the process core dump taken on windows?

Question

I have a full memory dump of a process taken through Task Manager.

Can I determine what the time was on the machine at that moment?

score 15 · Accepted Answer · edited Jul 15 '15 at 21:48

15

It's displayed in the Command window of WinDbg after you open the dump, as 'Debug session time'.

You can have it printed again with the .time meta-command.

edited Jul 15 '15 at 21:48

Thomas Weller

answered Jul 15 '15 at 17:31

gbr

note: the time is based on the machine doing the debugging. If the dump is from another time zone you need to use the -h parameter. – GBrookman Feb 02 '21 at 11:58

1 Answers1