How To Recover Lost Form Data From Browsers (macOS)

You were typing something very important and on clicking the submit button, an unknown error occurs. All the stuff you’ve typed just vanished. Hours of hard work, just gone. It’s painful, I can relate. Fortunately, there’s a way to recover that text by saving the RAM content.

In order to do this, you need to make sure that the System Integrity Protection is turned off on your mac.

How to disable SIP on your mac?

1. Click the Apple symbol in the Menu bar.
2. Click Restart…
3. Hold down Command-R to reboot into Recovery Mode.
4. Click Utilities.
5. Select Terminal.
6. Type csrutil disable.
7. Press Return or Enter on your keyboard.
8. Click the Apple symbol in the Menu bar.
9. Click Restart…

If you later want to start using SIP once again (and you really should), then follow these steps again, except this time you’ll enter csrutil enable in the Terminal instead.

Recovery

1. Open the Activity Monitor and get the process id of the tab that you want to recover the text from.
   (Depending on the browser, this can vary. Chrome for instance, uses a separate process for each tab. Some browsers may only have a single process handling all the tabs. In that case, just use the process id of the browser window instead of a single tab)
2. Fire up the terminal and type sudo lldb --attach-pid PROCESS_ID , replacing PROCESS_ID with the process id of your browser.
3. Once you’re attached to the process, type process save-core “LOCATION” , replacing LOCATION with the absolute path of the file where you want to save the data.
4. Download any Hex editor and load up the core file from the location you specified in step 3.
   (An editor that I often use can be downloaded here)
5. Search for the lost text and voila, you have your text recovered.