How do I recover information I've typed into a website after I accidentally lost the information?

Question

I typed a good amount of information into a form while in Safari, but I never bothered to save it and when I pressed to submit the data there was an error and I lost all the work I had done. Is there any way I can get the information I typed into the form back?

Solution

Here is how to do this on a Windows computer, unfortunately, these instructions don't work in OSX since there's no Hex Editor that can directly modify the RAM on a Mac. So we have to do a couple extra steps to dump the contents of the RAM to a readable file.

This looks like a long process, but it actually doesn't take long at all. I just broke it down into a lot of small steps so its very clear what to do.

Note: DO NOT CLOSE YOUR BROWSER OR ANY OF THE TABS ON YOUR BROWSER, THIS WILL MAKE THE DATA YOU ENTERED INTO THE BROWSER, WHICH YOU WANT TO RETRIEVE, IRRETRIEVABLE. You can still use your browser, but I recommend you open a new tab or window to work with.

1. First off open Terminal (search "Terminal" in spotlight if you don't know what Terminal is)
2. If you haven't installed X-Code install that from the Mac App Store

3. Then, if you have X-Code already installed or have already installed it copy and paste the following into Terminal and press enter

   xcode-select --install

4. Then copy and paste the following into terminal and press enter. This will install Homebrew

   ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)" < /dev/null 2> /dev/null

5. Then copy and paste the following into terminal to install gcore, which will allow you to dump the contents of an in-memory process

   brew install gcore

6. Now we can use gcore. Open the Activity Monitor. If you are using Chrome or Safari, you will see each tab you have open has its own process. Note the PID of the process that shares a name with the website URL or the tab where you lost your data. If you don't see any website URLs listed under "Process Name" then note the PID of the browser where you lost your data.

7. Now copy and paste the following into terminal, with "PID" being the PID you found in step 6. Note: This step will save a huge file, around 2gb-4gb, to your home folder.

   sudo gcore PID

   One example: sudo gcore 27719

8. Now that we have the core dump, which should be in your home folder with the name core.PID, we need to install a hex editor. I recommend Hex Fiend

9. After that open Hex Fiend, and open the core dump file.
10. Go to Edit > Find and then type some word that would only be part of the text that you lost. Or a phrase or sentence, if you can remember it exactly, that would only be part of the text that you lost.
11. That should find you the text that you lost, and you can now just copy that, and now you have all the tools in case you lose any web data ever again! If it doesn't show up at first try searching different words, and make sure to keep pressing find next to see every occurrence of your search input.

Comments

[Rafał Cieślak]

It doesn't seem to work on macOS 10.14, the system won't let me dump the memory of that process and gcore complains about insufficient privileges, event with sudo.

[I'm_With_Stupid]

Maybe this will help: stackoverflow.com/questions/39852691/…