49

I just submitted a form that included a text box, in which I had written a quite long text. In another textbox, I filled in a date in the wrong format - and instead of getting an error message, the web site just acted as if my form submission was valid, except nothing was saved.

Is there any way to see the history of what has been POST-ed (in the current session, at least), from where I can recover my lost text?

  • 4
    For this reason, I made it a habit of Ctrl-C'ing everything longer than a sentence. It's just so damn annoying when this happens. – Daniel Beck Jan 11 '11 at 14:22
  • 6
    @Daniel: For Chrome and Firefox, there's an extension called "Lazarus" which saves form entries. – user1686 Jan 11 '11 at 14:36
  • @grawity Thanks for the info. Not for Safari though, it seems. – Daniel Beck Jan 11 '11 at 14:39
  • @grawity: I tried Lazarus (on Firefox) for a while, but it was very buggy and more often than what is acceptable caused the entire browser to freeze. The concept is exactly what I'm looking for, but without the bugs =) – Tomas Aschan Feb 20 '11 at 23:17
5

I don't think Chrome (or any other browser, for that matter) saves a history of <textarea> (multiline input) contents.


If the form uses normal (non-Ajax) submission, and you haven't navigated away from the result page, there's a trick you can try: Open burp suite (the free version, of course), configure your browser to use localhost:8080 as a HTTP proxy, and press Refresh on the result page. The browser will ask you if you want to repeat the submission - which should then be captured in burp's "proxy" tab. (For unsecured HTTP, a packet sniffer such as Wireshark would work too.)

| improve this answer | |
  • Hi there, clicked Refresh and the browser didn't ask me anything. I downloaded Burp and 127.0.0.1:8080 is indeed in the Proxy tab. On my Chrome where the form is, I had to open up Proxy settings and clicked configure to add localhost:8080 as a HTTP Proxy. Note, it is currently bypassing *.local, 169.254/16 – Dhruv Ghulati Jun 30 '19 at 15:36
27
+100

Ok for real, I had to deal with this problem myself and I think I found a reliable solution:

  • first don't close the tab which you lost your post data.
  • then from the tools menu open task manager of chrome and find the pid.
  • afterwards use the process hacker to search for a portion of the string you have lost and continue till you find the longest consecutive data.
  • then copy and paste it to a text editor.

This way I was able to save my work today.

| improve this answer | |
  • 4
    !!!!!! Wow, you just saved me a ton of frustration. The Process Hacker operation is to right-click on the process with the matching PID and select "Create Dump File..." which creates a huge file but I was able to find the text in question. – Jason S Oct 2 '14 at 21:56
  • 1
    Thank you! I lost over an hour of work when I tried to save a wordpress post and this was the only way I could get it back. – Eddie Fletcher Dec 21 '14 at 1:57
  • 4
  • 1
    See superuser.com/a/1119310/30982 for Linux. – Elijah Lynn Aug 30 '16 at 21:20
  • Here is how you can efficiently search the file on the command line (e.g. cygwin under Windows 10): "fold -s chrome.exe.dmp > tmp.txt " to split the file into lines of 80 characters width and "grep --text -n 'Part of your entered text' tmp.txt" to get the content and line number of your search string. – user1323995 Jan 14 at 14:32
13

The answer by @rad works on Windows but doesn't for Linux. It led me to the following solution for Linux:

  1. Don't close the tab
  2. Go to Chrome Process Explorer with shift + esc
  3. Find Process ID (PID) of tab (e.g. 3982), if you don't see a Process ID column then right click a column title and turn on display
  4. Run gcore <PID> // creates the file core.3982 (binary)
  5. Then strings core.3982 | less // Converts the binary file to strings for searching, opens dump in Less
  6. Then search in less with / followed by enter and use n and p for next and previous results.

This was able to get me a POST that went missing in Chrome on Linux.

| improve this answer | |
  • Ahh, step #7 doesn't work in a normal Terminal, I am using Tmux so that is why it does. If someone has time to figure out a better step #7 please edit! – Elijah Lynn Aug 30 '16 at 21:05
  • Figured it out, piped to vim for searching there. – Elijah Lynn Aug 30 '16 at 21:15
  • 1
    strings -n didn't work... but strings alone did, then I piped to less... since I don't have vim installed – nmz787 Mar 20 '17 at 6:32
  • What does strings --version output? Mine is "GNU Strings 2.24". – Elijah Lynn Mar 21 '17 at 23:19
  • 2
    Nice. Unfortunately this doesn't work in OSX because of a special memory protection feature called SIP. This can actually be disabled in case you require this in the future by running csrutil disable from the recovery OS – quuxman Jun 5 '18 at 20:31
7

There is in fact a (somewhat cumbersome?) method of doing this in Chrome (and, in fact, any WebKit browser with WebInspector).

  1. On the page with the form, open the development console. This can be done by pressing F12.
  2. In the console that opens up, switch to the Network tab.
    • Optionally, ensure Preserve log is ticked and filter by Documents or XHR, as the case may be.
  3. Submit your form. Click on the newly created entry and go to the Headers tab. You'll see your submission under Form Data.
| improve this answer | |
  • This does not seem to correspond with the presentation in my current version of Chrome (47.0.2526.111 m). Would be nice to find out how it can be done. – James P. Jan 16 '16 at 3:32
  • 1
    @JamesPoulson The UI hasn't changed much, but Chrome now defaults to opening it in a side panel rather than a popup, and it shows a graph by default. You may need to click the double chevron (>>) in the top-right to find the Network tab. – Schism Jan 16 '16 at 4:16
  • 3
    This doesn't solve the problem. The problem is getting the request data after the fact. This only works if you've set it up before sending the request. – ToonAlfrink Sep 20 '19 at 11:12
5

I had some luck in Windows 10 using the following variation of the other suggestions

  1. Open Chrome Task Manager (press Shift+Esc)
  2. Find the tab that contained the text you have lost (search by name), make a note of the Process ID
  3. Open Windows Task Manager (press Ctrl+Shift+Esc)
  4. Go to the details tab and find the PID that matches your Process ID
  5. Right click that Process and click "Create Dump File"
  6. Open the large DMP file that is created in your C:\Users\username\AppData\Local\Temp folder called chrome.dmp
  7. Search the file for any text strings you can recall from the entered text
| improve this answer | |
2

I was on windows and nothing worked as other's answers, But recovered the lost data via dump, Please see the process below:

1 - first don't close the tab which you lost your post data. then from the tools menu open task manager of chrome and find the pid. 2 - Now open windows task manager & find the process with the PID, right click & click on "Create Dump File", it will create a dump in Windows Dir C:\Users\\AppData\Local\Temp\.DMP, it will give you the name also of the same.

Now open the file in notepad/Notepad++ and search for the text which you lost

| improve this answer | |
0

I succeed on window 7 in chrome. this is similar to Schism answer but complete (as the problem is that you already have pressed submit and then things exploded) :

  • don't close the page
  • on the page: open developer tools and go to its network tab
  • select all select all image
  • go back on the page
  • go forward on the page and get google resubmission notification
  • hit reload as instructed by the resubmission notification page
  • this either just works or the text will be in the form data of the post http call form data image
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.