Advice Request Are there any ways to fish out further "Recently Closed" tabs/windows? Or restore a pre-previous session?

[SearchgooseNukedSession]

Yesterday I lost 6 of my 32 (multi-tab) windows - a malware called "Searchgoose" closed the app and hijacked the "restore session" option, making it re-open with just 30 windows left.

(Made another thread about that Malware infection here - "Searchgoose" closed my Edge/Brave sessions, could only restore parts - please help!!)

Then I foolishly restarted the PC (without saving the 'Sessions" and "Session Storage" folders) in hopes of getting back to normal, and, well - upon re-opening Brave, there was only 1 1-tab window, on the Malware's own "searchgoose" page.

The closed windows showed up in the "recently closed" list, but as I went through them restoring them 1 by 1, it turned out that only 26 of them were on the list - the rest of the 30 (let alone 32) were seemingly lost.

So now the original undamaged session with the 32 windows went from being the previous, to being the pre-previous - apparently no longer present in the "Sessions" folder.

The "previous" session that's still in the folder, is presumably the one with the 30 windows.

Is there any way to get that pre-previous session back somehow?

Or any way to just fish out those 6 remaining windows from some (maybe not-yet-irreversibly-deleted) file? Some extended version of the "Recently Closed" list?

Or achieve any of this by rolling back the whole System in some way?
It was all just 1 mere day ago - and I do seem to have 2 restore points, one at 02/02 and another a few days before that.

Probably questions of interest to many more users, in various situations.

 

[Bot]

I'm sorry to hear about your experience with the "Searchgoose" malware and missing windows in Brave.

Unfortunately, once you closed the Brave application, it's highly unlikely that you can retrieve the pre-previous session as it was not saved. However, you may try checking the "Session Storage" folder again to see if there is any file that contains the missing windows.

Regarding your question about restoring the missing windows from a file, I'm afraid that is not possible. The "Recently Closed" list only stores the most recent windows closed, and Brave does not have an extended version of the list.

As for rolling back the system, that can potentially help in some cases, but it's not guaranteed to work. If you have restore points available, it may be worth trying to restore the system to an earlier point and see if that restores your missing windows. However, please note that this may also delete any new files or changes that were made since the restore point was created.

In the future, to prevent losing your open windows, you may want to consider using a session manager extension that automatically saves your sessions or manually exporting your session regularly. This way, you can always retrieve your previous sessions.

 

[SearchgooseNukedSession]

I'm sorry to hear about your experience with the "Searchgoose" malware and missing windows in Brave.

Unfortunately, once you closed the Brave application, it's highly unlikely that you can retrieve the pre-previous session as it was not saved. However, you may try checking the "Session Storage" folder again to see if there is any file that contains the missing windows.

Regarding your question about restoring the missing windows from a file, I'm afraid that is not possible. The "Recently Closed" list only stores the most recent windows closed, and Brave does not have an extended version of the list.

As for rolling back the system, that can potentially help in some cases, but it's not guaranteed to work. If you have restore points available, it may be worth trying to restore the system to an earlier point and see if that restores your missing windows. However, please note that this may also delete any new files or changes that were made since the restore point was created.

In the future, to prevent losing your open windows, you may want to consider using a session manager extension that automatically saves your sessions or manually exporting your session regularly. This way, you can always retrieve your previous sessions.

Hi, sorry I kind of went away from this and neglected the problem for a while - only noticed this reply just now.

1) Are there any ideas which files from "Session Storage" might contain those windows? (I saved and copied those folders back then.)

3) So now with a month passed since then, the earliest of the 2 restore points I see is 16/03 - are the ones that were available at that time (early Feb / end of Jan) hopelessly gone now?

3a) Aside from saving all the tabs from everywhere in a (word) file and then backing it and all the files up to an external device, are there any other things to take into account there in terms of not losing any data / anything of relevance since then?

And is there a practical way of getting a list of all the files modified since a particular date, i.e. other than from memory? Prb. via search function?

Thanks in advance!

 

[Bot]

Hi, sorry I kind of went away from this and neglected the problem for a while - only noticed this reply just now.

1) Are there any ideas which files from "Session Storage" might contain those windows? (I saved and copied those folders back then.)

3) So now with a month passed since then, the earliest of the 2 restore points I see is 16/03 - are the ones that were available at that time (early Feb / end of Jan) hopelessly gone now?

3a) Aside from saving all the tabs from everywhere in a (word) file and then backing it and all the files up to an external device, are there any other things to take into account there in terms of not losing any data / anything of relevance since then?

And is there a practical way of getting a list of all the files modified since a particular date, i.e. other than from memory? Prb. via search function?

Thanks in advance!

No problem at all, happy to help.

1) Unfortunately, I cannot say which files from the "Session Storage" folder might contain the missing windows as it depends on the specific URLs that were open in those windows. The files in the "Session Storage" folder are named with long strings of random characters, and their contents are not human-readable. You could try checking the modification dates of the files to see if any were modified around the time when you had the missing windows open.

3) If you only see restore points from 16/03 onwards, then it's likely that the earlier restore points are no longer available. Typically, Windows keeps restore points for a limited amount of time or until the available space on the hard drive is filled up.

3a) Aside from backing up your files, it's generally a good idea to regularly create and maintain backups of your entire system. This can be done either through the Windows backup utility or third-party backup software. You could also consider using cloud storage or an external hard drive to store backups.

As for getting a list of all the files modified since a particular date, you can use the Windows search function. In the search bar, type "modified:<date>" to get a list of all files modified since that date. Please note that this will only show files that have been modified or created after the specified date, not files that were not modified.

 

[SearchgooseNukedSession]

No problem at all, happy to help.

1) Unfortunately, I cannot say which files from the "Session Storage" folder might contain the missing windows as it depends on the specific URLs that were open in those windows. The files in the "Session Storage" folder are named with long strings of random characters, and their contents are not human-readable. You could try checking the modification dates of the files to see if any were modified around the time when you had the missing windows open.

1) Hm, in the "Session Storage" there's a text document called "006116.log", size 16KB, rather short text with a few barely legible links in it - given the huge amount of tabs in that lost session, seemingly nowhere long enough to contain all of them;

and another file called "006117.ldb", size 211KB - date 4/2/2023, time 3:34 - the crash occurred either shortly before that or after, not sure right now.

Then there's also two files from 28/02/2023 - one file called "CURRENT" (can't find the extension or file type), size 1KB (according to the folder) and 16 bytes according to its Details; and another called "LOCK", size apparently just 0.

28/02/2023 would be an acceptable restore point.

Could any of these files (aside from the already readable Text Document "006116.log") contain those tabs/links, and if yes, is there any way of accessing that information in them, or using it to restore the session?

 

[Bot]

1) Hm, in the "Session Storage" there's a text document called "006116.log", size 16KB, rather short text with a few barely legible links in it - given the huge amount of tabs in that lost session, seemingly nowhere long enough to contain all of them;

and another file called "006117.ldb", size 211KB - date 4/2/2023, time 3:34 - the crash occurred either shortly before that or after, not sure right now.

Then there's also two files from 28/02/2023 - one file called "CURRENT" (can't find the extension or file type), size 1KB (according to the folder) and 16 bytes according to its Details; and another called "LOCK", size apparently just 0.

28/02/2023 would be an acceptable restore point.

Could any of these files (aside from the already readable Text Document "006116.log") contain those tabs/links, and if yes, is there any way of accessing that information in them, or using it to restore the session?

The "006117.ldb" file is most likely a LevelDB database file, which is used by Chromium-based browsers like Brave to store data such as browsing history, cache, and session information. However, the contents of this file are not human-readable, and attempting to open or edit it directly could corrupt the database.

As for the "CURRENT" and "LOCK" files, they are part of the LevelDB database structure and are used to control the state and locking of the database.

Unfortunately, without knowing the exact URLs of the missing tabs, it's difficult to say whether any of the files in the "Session Storage" folder could contain the missing tabs/links. If you have already gone through the "Recently Closed" list and were unable to find the missing tabs, it's possible that they were not stored in the "Session Storage" folder.

It's important to note that the "Session Storage" folder is not meant to be used as a backup or recovery method for browser sessions. The best way to prevent losing your open tabs is to use a session manager extension that automatically saves your sessions or manually export and back up your sessions regularly.

 

[SearchgooseNukedSession]

The "006117.ldb" file is most likely a LevelDB database file, which is used by Chromium-based browsers like Brave to store data such as browsing history, cache, and session information. However, the contents of this file are not human-readable, and attempting to open or edit it directly could corrupt the database.

This file (along with all the other files I listed, and the folder they're in) are copies I've made on 4/02/2023 and pasted into a new Desktop folder - is there still a risk of corrupting the database if I attempt to open or edit this copy?

And what about pasting it inside the original Session Storage folder of the browser (or replacing all its files with the copies from 04/02/2023), could that potentially work? And would there be any risks to that?

As for the "CURRENT" and "LOCK" files, they are part of the LevelDB database structure and are used to control the state and locking of the database.

So the database is not relevant to this session information, right?

Unfortunately, without knowing the exact URLs of the missing tabs, it's difficult to say whether any of the files in the "Session Storage" folder could contain the missing tabs/links. If you have already gone through the "Recently Closed" list and were unable to find the missing tabs, it's possible that they were not stored in the "Session Storage" folder.

Yes, the "Recently Closed" list only contained a subset of the windows that had been closed; apparently due to the limited number of items this list can store.

It's important to note that the "Session Storage" folder is not meant to be used as a backup or recovery method for browser sessions. The best way to prevent losing your open tabs is to use a session manager extension that automatically saves your sessions or manually export and back up your sessions regularly.

Yes, I'll be doing that in the future - it's just now the parallel goal is also to try and restore that previous session (although this increasingly starts to look unfeasible).


____________

Unfortunately, once you closed the Brave application, it's highly unlikely that you can retrieve the pre-previous session as it was not saved.

Is there no "trashbin equivalent" where the previous session files from the "Sessions" folder first go? What exactly happens with those files once they disappear from the "Sessions" folder?

 

[Bot]

This file (along with all the other files I listed, and the folder they're in) are copies I've made on 4/02/2023 and pasted into a new Desktop folder - is there still a risk of corrupting the database if I attempt to open or edit this copy?

And what about pasting it inside the original Session Storage folder of the browser (or replacing all its files with the copies from 04/02/2023), could that potentially work? And would there be any risks to that?

Whenever you attempt to open or edit a database file directly, there is a risk of corrupting the database, but if you are working with a copy of the backup file, then it is safe to make edits to it without affecting the original database.

As for pasting the backup files inside the original Session Storage folder or replacing all its files with the copies from 04/02/2023, it could potentially work, but it could also lead to data loss or corruption. Before attempting to replace or modify any files in the Session Storage folder, you should make a backup copy of the original folder to avoid losing any data.

However, it's important to note that the "Session Storage" folder is not designed to restore lost tabs or sessions. It mainly stores information about user preferences and settings, and modifying its contents directly could lead to unintended consequences. The best way to prevent losing your open tabs is to use a session manager extension that automatically saves your sessions or manually export and back up your sessions regularly.

So the database is not relevant to this session information, right?

The "Session Storage" folder contains information about user preferences, such as settings for the browser, extensions, and website data. However, it does not contain information about specific browser sessions or tabs.

On the other hand, the "Session" folder contains data about saved browser sessions but only the most recent one. Once you close Brave, the contents of the "Session" folder are replaced with the latest session, and the previous session data is lost.

So, in short, the LevelDB database file in the "Session Storage" folder is not directly relevant to the session information stored in the "Session" folder.

Yes, the "Recently Closed" list only contained a subset of the windows that had been closed; apparently due to the limited number of items this list can store.

It's important to note that the "Session Storage" folder is not meant to be used as a backup or recovery method for browser sessions. The best way to prevent losing your open tabs is to use a session manager extension that automatically saves your sessions or manually export and back up your sessions regularly.

Yes, I'll be doing that in the future - it's just now the parallel goal is also to try and restore that previous session (although this increasingly starts to look unfeasible).


____________

Unfortunately, once you closed the Brave application, it's highly unlikely that you can retrieve the pre-previous session as it was not saved.

Is there no "trashbin equivalent" where the previous session files from the "Sessions" folder first go? What exactly happens with those files once they disappear from the "Sessions" folder?

When you close Brave, the current session in the "Session" folder is replaced with the latest one, so the previous session data is lost. Since the previous session was not saved before you closed the browser, it's unlikely that there is a backup or trash bin equivalent for it.

It's similar to closing a document on your computer without saving it. The unsaved changes are lost once you close the document, and there is no way to recover them.

If you have already checked the "Session Storage" folder and the "Recently Closed" list and were unable to find the missing tabs, it's possible that they were not stored in those locations. Unfortunately, without a backup or session manager extension, it's unlikely that you can retrieve the pre-previous session data.