Saving content from unresponsive exe

Question

Duplicate: How do I recover a form in Firefox without installing a plugin?

I have a notepad.exe process running that is unresponsive. I would like to save the contents. Can I somehow dump the process' current state and copy my text content from it?

Recover text data (non text binary would be a different solution) from hanging unresponsive process memory.

score 1 · Answer 1 · answered Jan 29 '13 at 10:46

1

The short answer is no. If the program is completely unresponsive, then you will have to kill the process.

If you think about it, if it were easy to recover data from an unresponsive program, operating systems would have such functionality built in.

answered Jan 29 '13 at 10:46

Keltari

71,875
26
179
229

I suspect the main reason operating systems don't have this functionality is that the application would immediately become unresponsive again once you restore its state. That doesn't necessarily mean the document is unsalvageable. – Marcks Thomas Jan 29 '13 at 11:59
The short answer is yes, but it's hard to do. – Jet May 02 '15 at 20:57
I think this answer is incorrect. Consider removing it. – user193661 Nov 06 '15 at 07:34

score 1 · Answer 2 · answered Jan 29 '13 at 17:24

1

A long answer is that in principle you could save the whole process (including the open file) to a file, and by use of forensic tools (and a detailed knowledge of how it represents data in memory) piece together what the program was doing. Only that is is probably much faster to just write the d*mn text again. I believe this will give you a taste of what is available.

answered Jan 29 '13 at 17:24

vonbrand

2,451
3
21
21

I think this answer is incorrect. Consider removing it. – user193661 Nov 06 '15 at 07:34

score 1 · Accepted Answer · answered Sep 09 '15 at 03:49

I've since taken a brief look at process dumps and found this problem to be very easy to solve, at least for notepad.

Create dump file for the process (you can use Task Manager)
Download the SysInternals tool, strings
Use strings.exe [input file path] > [output file path] in command line
There will be a bunch of other nonsense text in there as well and the file will be a few megabytes so you'll have to search for your text but it will be in there.
Don't use notepad

Saving content from unresponsive exe

3 Answers3