Recover overwritten .zshrc with still-running zsh

Question

I accidentally overwrote my .zshrc file after a misexecuted command, which contains several hundred lines of configs. However, I still have 5 terminals that had zsh open before this incident, and as a result, they are unaffected. However, any new shell I open loses the entire zsh config, and I have no backup for it.

I could simply continue using these 5 terminals, but I think there must be some form of way to extract the zshrc from memory, as ostensibly zsh loads the file into memory when run and stores it there until it's killed. I've tried this:

sudo dd if=/dev/mem bs=1M count=256|hexdump -C > ramfile

But all I've gotten is data unrelated to my zshrc.

Any solutions would be much appreciated.

Answer 1

I would have suggested using /proc/PID/fd/ directory, but zsh closes the file descriptor pointing to its configuration after parsing it. From that, my best guess is that your file in its original form is gone.

However, there are ways to dump zsh's current configuration, which may help you rebuild it. This other question's answer comes to mind:

All key bindings:

for m ($keymaps) bindkey -LM $m

All ZLE user widgets

zle -lL

All zstyles:

zstyle -L

Loaded modules:

zmodload -L

All variables:

typeset -p +H -m '*'

With the zsh/parameters module loaded, that will also include aliases, options, functions...

Answer 2

Self-Answer

A few other things I found when recovering my overwritten zsh:

Check if any copy of the zshrc still exists

This didn't happen in my case, but if by chance there is a version of the .zshrc somewhere (notably if your code editor of choice autosaves files to a specific location), there is a small possibility of it still existing somewhere. To find it, run this:

sudo find . -name ".zshrc"

Look in these specific locations:

• For Vim/Vi users (depends on config - might include /var/tmp, ~/.vim/sessions or ~/.local/share/nvim/swap)
• For Atom users - ~/.atom/recovery
• For Emacs users - by default you may have a file called ~/.zshrc~ available
• General - /tmp

Recovering manually-added paths

This script prints out all directories added to $PATH:

import subprocess
paths = subprocess.check_output("echo $PATH", shell=True, text=True)
list = paths.split(":")
for item in list:
    print("export PATH=" + item + ":$PATH")

Recover certain parameters

Use set to list all parameters, then grep through the ones you need, such as: the default editor (EDITOR) and pager (PAGER)

Answer 3

I had the same issue. Luckily, the ~/.zshrc.backup file had the previous contents of my .zshrc file. I copied its contents to restore. I suggest checking ~/.zshrc.backup if you haven't closed any tab with previous .zshrc running. (macOS)