54

I just submitted a form that included a text box, in which I had written a quite long text. In another textbox, I filled in a date in the wrong format - and instead of getting an error message, the web site just acted as if my form submission was valid, except nothing was saved.

Is there any way to see the history of what has been POST-ed (in the current session, at least), from where I can recover my lost text?

fixer1234
  • 28,064
Tomas Aschan
  • 3,556

7 Answers7

32

Ok for real, I had to deal with this problem myself and I think I found a reliable solution:

  • first don't close the tab which you lost your post data.
  • then from the tools menu open task manager of chrome and find the pid.
  • afterwards use the process hacker to search for a portion of the string you have lost and continue till you find the longest consecutive data.
  • then copy and paste it to a text editor.

This way I was able to save my work today.

Status3543
  • 3,461
rad
  • 520
22

The answer by @rad works on Windows but doesn't for Linux. It led me to the following solution for Linux:

  1. Don't close the tab
  2. Go to Chrome Process Explorer with shift + esc
  3. Find Process ID (PID) of tab (e.g. 3982), if you don't see a Process ID column then right click a column title and turn on display
  4. Run gcore <PID> // creates the file core.3982 (binary)
  5. Then strings core.3982 | less // Converts the binary file to strings for searching, opens dump in Less
  6. Then search in less with / followed by enter and use n and p for next and previous results.

This was able to get me a POST that went missing in Chrome on Linux.

Elijah Lynn
  • 1,602
8

There is in fact a (somewhat cumbersome?) method of doing this in Chrome (and, in fact, any WebKit browser with WebInspector).

  1. On the page with the form, open the development console. This can be done by pressing F12.
  2. In the console that opens up, switch to the Network tab.
    • Optionally, ensure Preserve log is ticked and filter by Documents or XHR, as the case may be.
  3. Submit your form. Click on the newly created entry and go to the Headers tab. You'll see your submission under Form Data.
Schism
  • 501
6

I had some luck in Windows 10 using the following variation of the other suggestions

  1. Open Chrome Task Manager (press Shift+Esc)
  2. Find the tab that contained the text you have lost (search by name), make a note of the Process ID
  3. Open Windows Task Manager (press Ctrl+Shift+Esc)
  4. Go to the details tab and find the PID that matches your Process ID
  5. Right click that Process and click "Create Dump File"
  6. Open the large DMP file that is created in your C:\Users\username\AppData\Local\Temp folder called chrome.dmp
  7. Search the file for any text strings you can recall from the entered text
Matt A
  • 61
5

I don't think Chrome (or any other browser, for that matter) saves a history of <textarea> (multiline input) contents.

If the form uses normal (non-Ajax) submission, and you haven't navigated away from the result page, there's a trick you can try: Open burp suite (the free version, of course), configure your browser to use localhost:8080 as a HTTP proxy, and press Refresh on the result page. The browser will ask you if you want to repeat the submission - which should then be captured in burp's "proxy" tab. (For unsecured HTTP, a packet sniffer such as Wireshark would work too.)

grawity
  • 501,077
2

I was on Windows and nothing worked as other's answers, but recovered the lost data via a dump. Please see the process below:

  1. First don't close the tab in which you lost your POST data. From the Tools menu open Task Manager of Chrome and find the PID.
  2. Now open Windows Task Manager and find the process with the PID, right click and click on Create Dump File, it will create a dump in C:\Users\<userid>\AppData\Local\Temp\<App_Name>.DMP, it will give you the name also.
  3. Now open the file in Notepad or Notepad++ and search for the text you lost.
Michel de Ruiter
  • 1,308
Anuj Tomar
  • 21
1

I succeed on window 7 in chrome. this is similar to Schism answer but complete (as the problem is that you already have pressed submit and then things exploded) :

  • don't close the page
  • on the page: open developer tools and go to its network tab
  • select all select all image
  • go back on the page
  • go forward on the page and get google resubmission notification
  • hit reload as instructed by the resubmission notification page
  • this either just works or the text will be in the form data of the post http call form data image
Burgi
  • 6,768
chad
  • 11