Has it ever happened that you typed a long and interesting text in a browser, carefully read it, and then, literally in a moment, you realized that an error occurred while accessing the site and your text in the form was deleted?

Basically, this happens because of the carelessness of site developers (in this case, by developers I mean not only a programmer who might not be aware of the necessary method, but also, for example, a manager who felt that it was too impractical to spend time on this): Web technologies (for example, Web Storage ) allow you to save and restore data (including form data) under almost any circumstances - up to accidentally closing the browser.

And yet, you wrote a long text exactly where nothing was done to save the form data.

Is it possible now to somehow restore the data if you cannot copy the text from the form and cannot send the POST request again?

Do not close your browser!

There is a solution

If it comes to Linux, then you can use a stunningly convenient way to dump the memory area that the browser uses. I first read about using this method to recover data lost in a browser on superuser.com , one of the StackExchange sites. This was a response from a user named Joey Adams to the question “How do I recover a form in Firefox * without * installing a plugin?” .

By the way, this method works not only on Linux.

For Windows, thanks Lord_D :

Dumps are very easily made by Process Explorer. There is PMDump for the console. And you can study the dump with some HEX editor (for example, from free ones - HxD) or with the same grep.

For Mac, thanks BeLove :

lldb --attach-pid PID

So, let's begin.

Step 1

Make sure you have gdb installed (GNU Debugger). You will need the gcore utility, which can dump RAM, which the running process with a specific PID uses.

Step 2

You didn’t close the browser, did you? In this case, find out the process number:

ps -e | grep firefox

Now run gcore to create a memory dump for this process:

gcore номер_процесса

If ptrace gives an error ( Operation not permitted) when trying to use gcore , this means that processes on your system cannot access the memory of other processes, not being their children processes (even if the UID matches). For example, you will see such an error in the latest versions of Ubuntu , if you did not change the corresponding value in the file /proc/sys/kernel/yama/ptrace_scope. Generally speaking, in this case, it is completely optional to reconfigure something - you can just run gcore on behalf of the superuser.

Step 3

The core.process_number file (for example, core.20727) appears in the current directory when gcore starts. By the way, keep in mind that file size can be very large. For example, I now have 934 MiB.

Now try using grep to check if the dump contains the necessary data. For example, if you mentioned the Safari browser in the text, then you can search by the word “Safari”:

grep 'Safari' core.20727

If you see a message that there is a match in the file ( Binary file core.20727 matches) - this is very good news, go to the fourth step. If there is no match, remember what else was in the text, and try to indicate something else.

Step 4

Now it remains to extract from the binary file the pieces you need with the text.

You can do this like this:

grep -B 20 -A 20 -a 'Safari' core.20727 > /tmp/out

In this case, you tell grep that you need to work with this binary as text, and that for each match, you must print 20 preceding and 20 subsequent lines.

Step 5

Now open the resulting file and find your text in it. For example, using less /tmp/out:



Have a nice evening. And do not forget about Ctrl + S. :)