How to recover form information for a webpage in Firefox

My method was tested in an emergency case (lost Facebook comment). It needs a third party tool – ProcessHacker. It's only for Windows – for a Linux method, check that question. It should work with every browser, not only Firefox.

There are two methods. First is more user friendly, but if PC would crash, you'd lose data. Second is more fail-safe, but needs an additional tool. With second you'd get a file you can give to some expert, if that tutorial would be too difficult. You can do Method II, steps 1&2 to be safe and then Method I to make it easier. I used Method I.

That's the exact list of steps I took:

Method I

1. The first thing to do is to pause the process. This is critical for success. I opened ProcessHacker (PH), found firefox.exe on the list (you can click on the "Name" column to get rid of the tree view and get a list view) and from the context menu I used "Suspend". Then it would look like Firefox is frozen, so if Windows would ask you about terminating not responding process, don't do it! It's alive, just sleeping.

2. Double click on the firefox.exe row or choose "Properties" from the context menu of firefox.exe.

3. Go to the "Memory" tab and click on the "Strings..." button in the top-right corner.

4. I used default settings ([✓] is checked checkbox, [ ] is unchecked) – Min. len.: 10; [✓] Detect Unicode; Search in [✓] Private / [ ] Image / [ ] Mapped. Click on the "OK" button.

5. After a while (up to minute, but probably a few seconds) you'd get all strings found. With such settings I've now over 700k strings. Check every one searching for the lost text. Just kidding! Go to the next point :)

6. Click on the bottom-left "Filter" and choose menu item that fits you the best. I used "Contains (case insensitive)".

7. Enter some word that was in your lost text. Word because some strings could be saved, e.g., as "foo bar". The longer and more unique word, the fewer results you'd get (so it will be easier). If you don't get results, try another word. I had my comment in two parts of the memory – in one it was full, in other just second half.

8. Look through the results. Most strings will be visible with null character after every char, e.g., foobar will be f.o.o.b.a.r (hex 66 00 6F 00 6F 00 62 00 61 00 72). Don't worry about it; it's the Unicode thing. If you'd find your text click on the "Save..." button. My comment was looking like part of HTML, i.e., it had <div> and <span> tags around.

9. Open the saved file in an editor that supports Unicode. I don't know about built-in Notepad, but it should work. I used Notepad++.

10. Find the text, copy the needed part. Say "hooray". You may now right click on firefox.exe row from the main window and choose "Resume".

Method II

1. Repeat step 1 from Method I.
2. Find firefox.exe row, right click on it and choose "Create dump file..." from the context menu.
3. Use some editor which supports loading big files. Notepad++ should handle it, but you need to turn off syntax coloring and spell checking. Examples: HxD (freeware, IMO better), wxHexEditor (FLOSS).
4. Go to step 10 from Method I.

Whew! I figured out a solution -- I was able to hit the "back" and "forward" button with the "Live HTTP Headers" extension capturing incoming/outgoing traffic, and the form information was part of a POST response. (Firefox will resend form input, not sure where that's stored, but doesn't have any obvious built-in way to display it to users)

I'd recommend you to install Lazarus - it has saved my butt enough number of times.