How can I read Chrome Cache files?

Question

A forum I frequent was down today, and upon restoration, I discovered that the last two days of forum posting had been rolled back completely.

Needless to say, I'd like to get back what data I can from the forum loss, and I am hoping I have at least some of it stored in the cache files that Chrome created.

I face two problems -- the cache files have no filetype, and I'm unsure how to read them in an intelligent manner (trying to open them in Chrome itself seems to "redownload" them in a .gz format), and there are a ton of cache files.

Any suggestions on how to read and sort these files? (A simple string search should fit my needs)

Solution 1

Try Chrome Cache View from NirSoft (free).

Solution 2

EDIT: The below answer no longer works see here

---

In Chrome or Opera, open a new tab and navigate to chrome://view-http-cache/

Click on whichever file you want to view. You should then see a page with a bunch of text and numbers. Copy all the text on that page. Paste it in the text box below.

Press "Go". The cached data will appear in the Results section below.

Solution 3

EDIT: The below answer no longer works see here

---

If the file you try to recover has Content-Encoding: gzip in the header section, and you are using linux (or as in my case, you have Cygwin installed) you can do the following:

1. visit chrome://view-http-cache/ and click the page you want to recover
2. copy the last (fourth) section of the page verbatim to a text file (say: a.txt)
3. xxd -r a.txt| gzip -d

Note that other answers suggest passing -p option to xxd - I had troubles with that presumably because the fourth section of the cache is not in the "postscript plain hexdump style" but in a "default style".

It also does not seem necessary to replace double spaces with a single space, as chrome_xxd.py is doing (in case it is necessary you can use sed 's/ / /g' for that).

Solution 4

EDIT: The below answer no longer works see here

---

Chrome stores the cache as a hex dump. OSX comes with xxd installed, which is a command line tool for converting hex dumps. I managed to recover a jpg from my Chrome's HTTP cache on OSX using these steps:

1. Goto: chrome://cache
2. Find the file you want to recover and click on it's link.
3. Copy the 4th section to your clipboard. This is the content of the file.
4. Follow the steps on this gist to pipe your clipboard into the python script which in turn pipes to xxd to rebuild the file from the hex dump: https://gist.github.com/andychase/6513075

Your final command should look like:

pbpaste | python chrome_xxd.py | xxd -r - image.jpg

If you're unsure what section of Chrome's cache output is the content hex dump take a look at this page for a good guide: http://www.sparxeng.com/blog/wp-content/uploads/2013/03/chrome_cache_html_report.png

Image source: http://www.sparxeng.com/blog/software/recovering-images-from-google-chrome-browser-cache

More info on XXD: http://linuxcommand.org/man_pages/xxd1.html

Thanks to Mathias Bynens above for sending me in the right direction.

Solution 5

Note: The flag show-saved-copy has been removed and the below answer will not work

---

You can read cached files using Chrome alone.

Chrome has a feature called Show Saved Copy Button:

Show Saved Copy Button Mac, Windows, Linux, Chrome OS, Android

When a page fails to load, if a stale copy of the page exists in the browser cache, a button will be presented to allow the user to load that stale copy. The primary enabling choice puts the button in the most salient position on the error page; the secondary enabling choice puts it secondary to the reload button. #show-saved-copy

First disconnect from the Internet to make sure that browser doesn't overwrite cache entry. Then navigate to chrome://flags/#show-saved-copy and set flag value to Enable: Primary. After you restart browser Show Saved Copy Button will be enabled. Now insert cached file URI into browser's address bar and hit enter. Chrome will display There is no Internet connection page alongside with Show saved copy button:

After you hit the button browser will display cached file.

View more solutions

Comments

[Raven Dreamer]

My antivirus program (Trend Micro) is shooting me warnings about that page -- can you validate its safe-ness?

[yakatz]

@Raven, I don't know the guy personally, but I have used many of his programs. What specifically does your antivirus say? The same site has what some people call hacking tools (i.e. password recovery)

[Raven Dreamer]

@Yakatz - nothing. It won't let me access the site at all because it's "a potential security risk". Guess I'll just have to disable it then.

[Raven Dreamer]

"The latest tests indicate that this site contains malicious software or could defraud visitors."

[yakatz]

@Raven, I don't see ratings like that about this site on other sites: mywot.com/en/scorecard/nirsoft.net. Google SafeBrowsing (google.com/safebrowsing/diagnostic?site=nirsoft.net) says the site has trojans on it, but those are likely false positives (since many security tools show up as trojans). There are no drive-by downloads, so you are safe anyway. I am sure the site is fine. As I said, I use his tools all the time.

[Raven Dreamer]

Unfortunately, Trend Microscan makes it impossible to override or temporarily turn itself off. Thankfully, I have two computers, and a flash drive.

[Druska]

The file you receive might be an unreadable dump. Send the file through this php script to extract the contents: sensefulsolutions.com/2012/01/…

[zinking]

you didn't even mention you are using sensefulsolutions page.

[Mathias Bynens]

Or just copy the hexdump for a file to the clipboard and then run pbpaste | xxd -r -p > file.ext, replacing pbpaste with your operating system’s equivalent for this OS X utility.

[Mahn]

Worked great for me, none of the other methods did, thanks!

[Rob W]

Without even having to save to a file: Select the part below the header, and use xsel | xxd -r | zcat | less (omit | less if you don't want a pager).

[ccpizza]

And also works on Mac under Wine. The folder for the main Chrome profile will be something like H:\Library\Caches\Google\Chrome\Default\Cache assuming that H: is mapped to your home folder.

[Slava Bacherikov]

This will not work anymore, cause chrome://view-http-cache is removed from recent chrome versions. Fore more details see this.

[jengeb]

Isn't there a built-in browser tool to use?

[Marco]

chrome://cache was removed in later versions of Chrome so this will no longer work.

[Marco]

chrome://view-http-cache/ was removed in newer versions of Chrome.

[AKX]

Cheers, this helped with implementing github.com/akx/cachemoney :)