Has it ever happened that you typed a long and interesting text in your browser, carefully read it, and then, literally a moment later, you understood that an error occurred while accessing the site and your text in the form was erased?

This is mainly due to the negligence of site developers (by developers, in this case, I mean not only a programmer who might not have been aware of the desired method, but also, for example, a manager who thought that spending time on this was too impractical): modern Web technologies (for example, Web Storage ) allow you to save and restore data (including form data) under almost any circumstances - up to accidentally closing the browser.

And, nevertheless, you wrote a long text exactly where nothing was done to save the form data.
')
Is it possible now to somehow restore the data, if you can not copy the text from the form and can not send a POST request again?

Do not close the browser!

There is a solution

If it happens in Linux, then you can use an incredibly convenient way to dump the memory area that the browser uses. I first read about applying this method to recover data lost in the browser on superuser.com - one of the StackExchange sites. This was a response from a user named Joey Adams to the question “How do I recover a firefox * without * installing a plugin?” .

By the way, this method works not only in Linux.

For Windows, thanks Lord_D :

Dumps are very easy to do with Process Explorer. For console there is a PMDump. And you can study the dump with some HEX editor (for example, from free ones - HxD) or the same grep.

For Mac, thanks to BeLove :

lldb --attach-pid PID 

So, let's begin.

Step 1

Make sure you have gdb (GNU Debugger) installed. You will need the gcore utility, which can dump the RAM that the running process uses with a certain PID.

Step 2

You didn't close the browser, did you? In this case, find out the process number:

ps -e | grep firefox

Now run gcore to create a memory dump for this process:

gcore _

If ptrace when trying to use gcore gives an error ( Operation not permitted ), this means that processes on your system cannot access the memory of other processes, not being their child processes (even if the UID coincides). For example, you will see this error in the latest versions of Ubuntu , if you did not change the corresponding value in the /proc/sys/kernel/yama/ptrace_scope . Generally speaking, in this case it is not necessary to reconfigure something - you can simply run gcore on behalf of the superuser.

Step 3

The file core.number_process appears in the current directory when gcore is started (for example, core.20727). By the way, keep in mind that the file size can be very large. For example, I got it now 934 MiB.

Now try using grep to check if the necessary data is in the dump. For example, if in the text you mentioned the Safari browser, then you can search by the word "Safari":

grep 'Safari' core.20727

If you see a message that there is a match in the file ( Binary file core.20727 matches ) - this is very good news, go to step four. If there is no match - remember what else was in the text, and try to specify something else.

Step 4

It now remains to extract from the binary file the pieces you need with the text.

You can do it like this:

grep -B 20 -A 20 -a 'Safari' core.20727 > /tmp/out

In this case, you tell grep that this binary file is required to work as with text, and that for each match you need to output 20 preceding and 20 subsequent lines.

Step 5

Now open the resulting file and find your text in it. For example, using less /tmp/out :



Have a nice evening. And do not forget about Ctrl + S. :)