A method for analyzing memory after a system panic to identify scope and cause of memory corruption. The method includes retrieving a memory image for a computer system and identifying a data structure in the memory image that caused the panic. A rule set for the identified data structure is selected and applied to the memory image to determine a scope of the memory corruption. The method includes identifying data structures in the memory that are related to the identified data structure by type, structure, content, or location and applying the rule set to this subset of data structures. The method may include generating the rule set for the identified data structure and then validating the created rule set such as by applying it to data structures that are known to be uncorrupted. The corrupted data structures are then processed to determine a cause of the corruption.