How can I check what time was the process core dump taken on windows?

Question

I have a full memory dump of a process taken through Task Manager.

Can I determine what the time was on the machine at that moment?

Seldan

Answer 1

It's displayed in the Command window of WinDbg after you open the dump, as 'Debug session time'.

You can have it printed again with the .time meta-command.

Modesta

note: the time is based on the machine doing the debugging. If the dump is from another time zone you need to use the -h parameter. – Kahn