3

Duplicate: How do I recover a form in Firefox without installing a plugin?

I have a notepad.exe process running that is unresponsive. I would like to save the contents. Can I somehow dump the process' current state and copy my text content from it?

Recover text data (non text binary would be a different solution) from hanging unresponsive process memory.

3 Answers 3

1

The short answer is no. If the program is completely unresponsive, then you will have to kill the process.

If you think about it, if it were easy to recover data from an unresponsive program, operating systems would have such functionality built in.

3
  • I suspect the main reason operating systems don't have this functionality is that the application would immediately become unresponsive again once you restore its state. That doesn't necessarily mean the document is unsalvageable. Jan 29, 2013 at 11:59
  • The short answer is yes, but it's hard to do.
    – Jet
    May 2, 2015 at 20:57
  • I think this answer is incorrect. Consider removing it.
    – user193661
    Nov 6, 2015 at 7:34
1

A long answer is that in principle you could save the whole process (including the open file) to a file, and by use of forensic tools (and a detailed knowledge of how it represents data in memory) piece together what the program was doing. Only that is is probably much faster to just write the d*mn text again. I believe this will give you a taste of what is available.

1
  • I think this answer is incorrect. Consider removing it.
    – user193661
    Nov 6, 2015 at 7:34
1

I've since taken a brief look at process dumps and found this problem to be very easy to solve, at least for notepad.

  1. Create dump file for the process (you can use Task Manager)
  2. Download the SysInternals tool, strings
  3. Use strings.exe [input file path] > [output file path] in command line
  4. There will be a bunch of other nonsense text in there as well and the file will be a few megabytes so you'll have to search for your text but it will be in there.
  5. Don't use notepad

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .