54

I just submitted a form that included a text box, in which I had written a quite long text. In another textbox, I filled in a date in the wrong format - and instead of getting an error message, the web site just acted as if my form submission was valid, except nothing was saved.

Is there any way to see the history of what has been POST-ed (in the current session, at least), from where I can recover my lost text?

Improve this question
5
  • 5
    For this reason, I made it a habit of Ctrl-C'ing everything longer than a sentence. It's just so damn annoying when this happens.
    – Daniel Beck ♦
    Jan 11, 2011 at 14:22
  • 6
    @Daniel: For Chrome and Firefox, there's an extension called "Lazarus" which saves form entries.
    – u1686_grawity
    Jan 11, 2011 at 14:36
  • @grawity Thanks for the info. Not for Safari though, it seems.
    – Daniel Beck ♦
    Jan 11, 2011 at 14:39
  • @grawity: I tried Lazarus (on Firefox) for a while, but it was very buggy and more often than what is acceptable caused the entire browser to freeze. The concept is exactly what I'm looking for, but without the bugs =)
    – Tomas Aschan
    Feb 20, 2011 at 23:17
  • Seems like data are lost after clicking the link in the viewed page and going back within the same tab.
    – koubin
    May 19, 2021 at 15:06

7 Answers 7

Reset to default
5

I don't think Chrome (or any other browser, for that matter) saves a history of <textarea> (multiline input) contents.

If the form uses normal (non-Ajax) submission, and you haven't navigated away from the result page, there's a trick you can try: Open burp suite (the free version, of course), configure your browser to use localhost:8080 as a HTTP proxy, and press Refresh on the result page. The browser will ask you if you want to repeat the submission - which should then be captured in burp's "proxy" tab. (For unsecured HTTP, a packet sniffer such as Wireshark would work too.)

Improve this answer
1
  • Hi there, clicked Refresh and the browser didn't ask me anything. I downloaded Burp and 127.0.0.1:8080 is indeed in the Proxy tab. On my Chrome where the form is, I had to open up Proxy settings and clicked configure to add localhost:8080 as a HTTP Proxy. Note, it is currently bypassing *.local, 169.254/16
    – Dhruv Ghulati
    Jun 30, 2019 at 15:36
31
+100

Ok for real, I had to deal with this problem myself and I think I found a reliable solution:

  • first don't close the tab which you lost your post data.
  • then from the tools menu open task manager of chrome and find the pid.
  • afterwards use the process hacker to search for a portion of the string you have lost and continue till you find the longest consecutive data.
  • then copy and paste it to a text editor.

This way I was able to save my work today.

Improve this answer
6
  • 5
    !!!!!! Wow, you just saved me a ton of frustration. The Process Hacker operation is to right-click on the process with the matching PID and select "Create Dump File..." which creates a huge file but I was able to find the text in question.
    – Jason S
    Oct 2, 2014 at 21:56
  • 1
    Thank you! I lost over an hour of work when I tried to save a wordpress post and this was the only way I could get it back.
    – Eddie Fletcher
    Dec 21, 2014 at 1:57
  • 5
    Process memory dump can be stored to file via task manager and searched with sysinternals strings tool.
    – Vadzim
    Apr 5, 2015 at 13:59
  • 1
    See superuser.com/a/1119310/30982 for Linux.
    – Elijah Lynn
    Aug 30, 2016 at 21:20
  • 1
    Here is how you can efficiently search the file on the command line (e.g. cygwin under Windows 10): "fold -s chrome.exe.dmp > tmp.txt " to split the file into lines of 80 characters width and "grep --text -n 'Part of your entered text' tmp.txt" to get the content and line number of your search string.
    – user1323995
    Jan 14, 2020 at 14:32
21

The answer by @rad works on Windows but doesn't for Linux. It led me to the following solution for Linux:

  1. Don't close the tab
  2. Go to Chrome Process Explorer with shift + esc
  3. Find Process ID (PID) of tab (e.g. 3982), if you don't see a Process ID column then right click a column title and turn on display
  4. Run gcore <PID> // creates the file core.3982 (binary)
  5. Then strings core.3982 | less // Converts the binary file to strings for searching, opens dump in Less
  6. Then search in less with / followed by enter and use n and p for next and previous results.

This was able to get me a POST that went missing in Chrome on Linux.

Improve this answer
11
  • Ahh, step #7 doesn't work in a normal Terminal, I am using Tmux so that is why it does. If someone has time to figure out a better step #7 please edit!
    – Elijah Lynn
    Aug 30, 2016 at 21:05
  • Figured it out, piped to vim for searching there.
    – Elijah Lynn
    Aug 30, 2016 at 21:15
  • 1
    strings -n didn't work... but strings alone did, then I piped to less... since I don't have vim installed
    – nmz787
    Mar 20, 2017 at 6:32
  • 4
    Nice. Unfortunately this doesn't work in OSX because of a special memory protection feature called SIP. This can actually be disabled in case you require this in the future by running csrutil disable from the recovery OS
    – quuxman
    Jun 5, 2018 at 20:31
  • 1
    Saved my life, thanks! The file created was 20GB on my machine, so be patient once you run the gcore command
    – Jemo
    Oct 13, 2021 at 13:15
8

There is in fact a (somewhat cumbersome?) method of doing this in Chrome (and, in fact, any WebKit browser with WebInspector).

  1. On the page with the form, open the development console. This can be done by pressing F12.
  2. In the console that opens up, switch to the Network tab.
    • Optionally, ensure Preserve log is ticked and filter by Documents or XHR, as the case may be.
  3. Submit your form. Click on the newly created entry and go to the Headers tab. You'll see your submission under Form Data.
Improve this answer
3
  • This does not seem to correspond with the presentation in my current version of Chrome (47.0.2526.111 m). Would be nice to find out how it can be done.
    – James P.
    Jan 16, 2016 at 3:32
  • 1
    @JamesPoulson The UI hasn't changed much, but Chrome now defaults to opening it in a side panel rather than a popup, and it shows a graph by default. You may need to click the double chevron (>>) in the top-right to find the Network tab.
    – Schism
    Jan 16, 2016 at 4:16
  • 9
    This doesn't solve the problem. The problem is getting the request data after the fact. This only works if you've set it up before sending the request.
    – ToonAlfrink
    Sep 20, 2019 at 11:12
6

I had some luck in Windows 10 using the following variation of the other suggestions

  1. Open Chrome Task Manager (press Shift+Esc)
  2. Find the tab that contained the text you have lost (search by name), make a note of the Process ID
  3. Open Windows Task Manager (press Ctrl+Shift+Esc)
  4. Go to the details tab and find the PID that matches your Process ID
  5. Right click that Process and click "Create Dump File"
  6. Open the large DMP file that is created in your C:\Users\username\AppData\Local\Temp folder called chrome.dmp
  7. Search the file for any text strings you can recall from the entered text
Improve this answer
2

I was on Windows and nothing worked as other's answers, but recovered the lost data via a dump. Please see the process below:

  1. First don't close the tab in which you lost your POST data. From the Tools menu open Task Manager of Chrome and find the PID.
  2. Now open Windows Task Manager and find the process with the PID, right click and click on Create Dump File, it will create a dump in C:\Users\<userid>\AppData\Local\Temp\<App_Name>.DMP, it will give you the name also.
  3. Now open the file in Notepad or Notepad++ and search for the text you lost.
Improve this answer
1

I succeed on window 7 in chrome. this is similar to Schism answer but complete (as the problem is that you already have pressed submit and then things exploded) :

  • don't close the page
  • on the page: open developer tools and go to its network tab
  • select all select all image
  • go back on the page
  • go forward on the page and get google resubmission notification
  • hit reload as instructed by the resubmission notification page
  • this either just works or the text will be in the form data of the post http call form data image
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .