Imagine that you have written a very long post on a forum you like. Everything is edited and you press “send”, The screen begins to change, and after a little while loading, it tells you that your post failed. You try to hit the back arrow, but your post hasn't been saved in the text field. Your post has vanished into the either, is there a way to get it back? The answer is Yes!

One way to recover an old post on firefox is to dump the program's core, and then search the core of the post you wrote. For this to work, it needs to be the case that you didn't close the program, or any relevant tabs. I got this trick from https://superuser.com/questions/975744/how-do-i-recover-information-ive-typed-into-a-website-after-i-accidentally-lost

Basic instructions

The first thing to do is to dump the program's core this can be done by finding the firefox process's PID, and then using the “gcore” command to dump the core of it.

ps -e | grep -i firefox sudo gcore 31337

where 31337 is the PID you got from the ps -e command (It will be a different number in your case probably).

After that you should get a file called “core.31337” which contains the contents of the entire firefox program. Part of the core will have the contents of the post you lost.

Searching the core

Hex editor

If you have a good hex editor, you can usually search for a section of the post you lost in the core file and then copy and paste it a text file.

Unix command line

I didn't feel like going into a hex editor so I decided to use command line utilities instead. The first problem I had was that the core was bigger than the amount of ram I had available, so I needed to split it into lines each program could process at a time. I did this with the fold command, and then I piped it into a tr command which deleted all of the binary. I took the command from: https://stackoverflow.com/questions/9988379/how-to-grep-a-text-file-which-contains-some-binary-data

After that, I searched for a section of text within the file that had part of the post I wrote

fold -bw 1024 < core.31337 | tr '[\000-\011\013-\037\177-\377]' '.' > dump grep -ni 'monkeys are primates' dump

From those commands, grep gave me a line number on where my post was located around, so I needed to grab all the lines around that post, Which I did with sed (I simply took the number from grep -n and then I made a sed command to print the sections around that number by adding and subtracting it by about 20 lines.

sed -n '39999990,40000050p;40000051q' dump > oldpost cat oldpost

This was a small enough file that I could copy and paste the post, remove any extra periods, rejoin any lines I was missing, and then copy paste the post back into the form.

---

By Logan Andersen. This work is licensed under CC BY-SA 4.0

You can see my other blogs here.