2
I was typing in notepad I then clicked save and it hanged so I went to task manager and clicked on the hanged process of notepad.exe "Create Dump File". I never got to save my .txt file ony the .dmp file. My dump file says notepad.dmp and is 104MB. Is there anyway I can recover my text from the dump file?
Needurhelppl
Posted 2014-09-26T22:19:27.083
Reputation: 21
2
Yes, there is. The dump created a copy of the program's memory, so all you need to do is get a hex editor like the excellent HxD. Open your .dmp file, which is located in %TEMP%\notepad.dmp in this case.
Now press Ctrl+F and search for a piece of your text. Make sure to check "Unicode string."
Your text should automatically be highlighted where it is found. Note that the address may differ.
If the null between each character is annoying you, try Find + Replace to remove as much of it as you can..
And remember... don't ever type anything important on Notepad!
oldmud0
Posted 2014-09-26T22:19:27.083
Reputation: 3 858
Autosave is a nice feature, tho I overely on it with sublime text 2 – Journeyman Geek – 2015-05-02T03:43:58.207
@oldmud0, Odd, why would they be stored as Unicode strings.. – Pacerier – 2015-11-20T03:11:48.330
@oldmud0, Hey bro, any tips on how to recover data when I don't have information regarding the text to "Ctrl+F"? – Pacerier – 2015-11-20T03:11:50.863
@Pacerier well, you can always scroll through the hex dump manually. This should be pretty easy to do if the file you want to recover is fairly large and has mostly text (not a binary file...). – oldmud0 – 2015-11-20T03:13:53.123
@oldmud0, It's a text file, but "Scrolling manually" doesn't work because it will take about 200 hours to scroll through them and the thing is I am not not quite sure how big the file is (it might be all of 10 lines), so I'll have to scroll even more slowly to be able to catch that text file :( There got to be some format that we can search right? Like starting bytes or ending bytes? – Pacerier – 2015-11-29T03:01:06.467
@Pacerier Look for common words like "that" or "and". The file contents usually begin at the very beginning of the dump file, at about 0xD71A0. – oldmud0 – 2015-11-29T05:17:57.643
@oldmud0, Wow dude, you're a life saver! I'm lucky, there is a lot of false positives (e.g. http://i.stack.imgur.com/LF3N8.png , http://i.stack.imgur.com/DyOnI.png) and I was about to give up when I found it. Odd that your's is way up at the top. I actually found it at 2ce930. If I test with a new notepad now (win 8.1), it appears at 203a990. And if Ctrl-S subwindow is open, it appears at 3169bf0.
1Smart for making a dump file. – oldmud0 – 2015-05-02T01:41:51.933