The mistake<\/h3>\n
I was probably not really focused, but instead of\u00a0transferring\u00a0from my site to my local computer, I transfered the other way round and lost all my logs of the last 4 days! Argh! I’m sure the next time I will examine the “Are you sure you want to overwrite this file?” popup carefully.<\/p>\n
The failed strategies<\/h3>\n
Here is a list of actions I made trying to recover data:<\/p>\n
- \n
- As I looked at my stats log online a few hours earlier, I hoped that I kept a tab open in my browser but I didn’t.<\/li>\n
- I checked the automatic backup of my hosting provider, but the daily backup was made 20 hours ago. That’s already a few days recovered, but I hoped to recover more of it.<\/li>\n
- I looked into Chrome cache folder, only to find 285 Mb of strangely-named binary files. That will not get me anywhere.<\/li>\n
- I looked for a free app to access chrome cache but the only one I found only told me which binary file contained my log file (ChromeCacheView<\/a>).<\/li>\n<\/ul>\n
However, this last app gave me hope because it displayed information about the name and date of the file I was looking for. Only 3 hours from the mistake.\u00a0Losing 3 hours of log would be acceptable.<\/p>\n
The Solution<\/h3>\n
Looking on google, I found that Chrome has an interesting integrated cache viewer that could have helped me from the beginning. By typing about:cache<\/em> in the\u00a0address\u00a0bar, you access a list of cached files. You can also type a direct url if you know the file in the following form: chrome:\/\/view-http-cache\/http:\/\/example.com\/file.htm<\/em>. I thought I found the solution and quickly accessed my log file. However, Chrome does not simply give you a way to get the cached file but instead displays raw data with HTTP headers<\/a> and data received from the server. For my file, it gave me something like that (click for full size<\/em>):<\/p>\n
![\"chrome_cache\"](\"http:\/\/www.frozax.com\/blog\/wp-content\/uploads\/2011\/05\/chrome_cache-300x236.png\" "\\"chrome_cache\\"")
<\/a><\/p>\nAs you can see in the red circle, it’s pretty obvious that the binary data displayed below is\u00a0gzip<\/a> data, and not plain text sadly. However, the presentation in Chrome is not really handy to get the real binary data because it contains on the left the addresses and on the right the binary form. The useful part is the hexadecimal version on the middle.<\/p>\n
An article on Alex Korn site<\/a> gives a php script he used to extract the file content section of Chrome cache into a text file. It won’t be that simple in my case because my content is binary but it’s a good start. Alex Korn had his text file directly visible. The first time I ran this php script, I had errors extracting the gzip file (corrupted data). After a closer look it’s because of the reg exp used in the preg_match_all<\/em>. Some data on the right side (binary) could match the reg exp and inject invalid bytes. I replaced the reg exp by using spaces (s) instead of whitespaces (b) and added code to directly decode the gzip data. This is the full script I used:<\/p>\n
\n
\/\/ cache.log is a copy of chrome cache page with only the file content section\r\n$cacheString = file_get_contents(\"cache.log\");\r\n$matches = array();\r\npreg_match_all('\/s[0-9a-f]{2}s\/', $cacheString, $matches);\r\n$f = fopen(\"t.bin\",\"wb\");\r\nforeach ($matches[0] as $match)\r\n{\r\n fwrite($f,chr(hexdec($match)));\r\n}\r\nfclose($f);\r\n\r\nob_start();\r\nreadgzfile(\"t.bin\");\r\n$decoded_data=ob_get_clean();\r\necho $decoded_data;<\/pre>\n<\/blockquote>\nAnd that did it, I finally recovered my file!<\/p>\n
Conclusion<\/h3>\n
I know this article is really specific but as I said in the beggining, I really hope people looking for this information will find it here instead of spending as much time as I did figuring it out.<\/p>\n
You can follow me on twitter<\/a> or facebook<\/a>, and feel free to comment this article here.<\/p>\n