Lazarus: Form Recovery

What is Lazarus?

Lazarus 2 is a free Firefox browser add-on (Don't have Firefox? Get the all new cross-browser Lazarus 3!) which makes backups of the data you've entered into web forms. It then stores this data so you can easily recover it if you need to re-enter it for some reason. Many of us have had the experience of spending ages entering data into a long form, only to see it vanish when an error occurs after we try to submit it. With Lazarus, this need never happen again!

How do I use Lazarus?

Lazarus will automatically save the data you enter into a form while you are typing, and will also save the form as soon as you hit the submit button. If you need to re-enter the data into the form, simply go back to that page again, right-click in one of the fields in the form, or just within the part of the web page that the form occupies, and select "Recover form" from the menu. Lazarus will then retrieve what it saved and automatically put it back into the form.

By default your form information is kept indefinitely, but if you're concerned about security you can have it removed after a specified time.

I've lost my password

Where does Lazarus keep the saved forms?

Lazarus saves all its form information inside an SQLite database ("lazarus.sqlite") located in your profile folder. The data is encrypted to protect your privacy (see below).

Is my form information secure?

As much as possible.

First, all of your data is stored locally on your PC. Second, the form data is encrypted within the database.

We've taken some pains to ensure your data is easily available to you but not easily accessible by other people. As of Lazarus 2.0 we are now using RSA and AES hybrid encryption to save your private data. This allows Lazarus to save form data without you having to enter your Lazarus password (Your password is only required to restore a form). We believe this gives a good combination of security, speed and useability.

There are settings to remove form information after a set time. If you enable this, the form info will be deleted from the database once it has expired.

If you do not have a Lazarus Password set, then your private data will still be encrypted. However, anyone with access to your computer will be able to retrieve specific forms by restoring them one at a time. A user only needs to right click and click "Restore" to view the contents of a form. So if users have physical access to your machine whilst the browser is running, they could access your form details.

Can I disable Lazarus for certain sites?

Yup, just right click on the Lazarus icon in the statusbar and select "Disable Lazarus on this site".
Lazarus will no longer save data entered into forms on this site. If you make a mistake you can re-enable Lazarus by right clicking on the icon and selecting "Enable Lazarus on this site".

Can I recover lost text without going to the page I typed it into?

Yes. In Lazarus 2.0 we introduced the ability to search through the text you have entered into textareas (and WYSIWYG editors) to find data you may not be able to recover in other ways.

Just select "Search Lazarus" from the Lazarus status bar menu. However, this index, by necessity, is not quite as strong as the rest of Lazarus's rock solid security. See below...

Why would anyone disable text search?

An attacker who gained access to your Firefox profile directory, copied your Lazarus database, and mounted a dictionary attack on the search index, might be able to figure out some of the words that are in the forms you've saved.

Lazarus does not store the search index in plain text of course, but first applies a salted hash to every word before indexing it. The "salt" is randomly generated, but is stored unencrypted, which means that if an attacker steals that as well, they can use it to mount a dictionary attack against the words in the index, and eventually discover some of the words that you have entered into forms. The locations of the forms will still be secure if you are using a password for Lazarus

If you're worried about this, you should turn off the text indexing.

We have some ideas about how to make the index more secure that we may introduce in future versions

Does Lazarus save every form?

We try to save every form, but some things are beyond our control. We fully support "normal" HTML forms, and should have no trouble recovering all data from these.
WYSIWYG, AJAXified forms, and Richtext textboxes pose a more difficult problem however, as some of these elements are not considered part of a "form" as such. For these special cases we have introduced the "Recover Text" option. Which should allow you to recover any text entered into a WYSIWYG editor, textarea, or Richtext textbox on a per domain basis.

Neither Flash nor Java based forms are supported.

What does the "(A)" in the recover form context menu mean?

Lazarus has various different types of saved forms. This is an indicator to tell you what type of save was made.

• (A): Autosave: the form was saved whilst you were entering data into it. It's possible that this form was never sent to a website.
• (S): Submitted: The form was saved just before you submitted it to the server.

Where did you get the graphics from?

Mark James makes spectacular tiny icons that I use heaps (thanks Mark). For the larger images (such as in the options dialog) I used the Aesthetica icon set, version 2.0 from dryicons.com.

I need some help with Lazarus!

Contact us at lazarus AT interclue DOT com to ask questions, report bugs, request more features or tell us what you think of the program. We're happy to hear from our users and to help them when needed.

General Problems

Occasionally there are problems with Lazarus, usually caused by conflicts with other add-on or by a corrupt database file. If you are having problems then you can try some of the following steps to help track down what might be cause.

1. • Enable error reporting in Firefox.
   • Open the Error Console (click Tools | Error Console)
   • Then re-create the error

   If you get an error or warning in the console then copy and paste in to us along with an explanation of the error and we'll see what we can do.

2. • Disable all other addons
   • Then try and re-create the error

   If you can no longer create the problem then there is probably a conflict with another add-on.

   • Enable your other add-ons one at a time until the problem occurs again.
   • Verify that it's just the one add-on causing the conflict by disable all your add-ons except Lazarus and the one that caused the problem and then re-creating the error

   If you've found the conflicting add-on then please email us because if you are suffering from the problem, then there's probably a bunch of other people also suffering from it. We'll try or best so solve the conflict.

3. If your lazarus.sqlite database file becomes corrupted, then there is only one solution, and that is to rebuild the Lazarus database. This should be a method of last resort as doing this will remove all saved forms from the database and cannot be undone.

Enabling Error Reporting in Firefox

• type "about:config" (without the quotes) into your addressbar and hit [enter]
• type "javascript" into the filterbox and locate the javascript.options.showInConsole entry
• set the javascript.options.showInConsole entry to true (double clicking on the row should work)

Disabling other add-ons

• open the addons dialog (Tools | Add-ons)
• click on the first add-on in the list (disable and uninstall buttons should appear on the right side of the highlighted add-on)
• click the disable button (an infobar should appear at the top of the dialog asking you to restart Firefox. Do not restart until all of your add-ons are disabled)
• Disable all of the add-ons except Lazarus
• then click the "Restart Firefox" button in the infobar

All off your add-on (except Lazarus) should now be disabled.

Rebuilding Your Lazarus Database

This will remove all of your saved forms and cannot be undone!

Rebuilding the database should be considered a last resort. It requires a restart of Firefox (because the database file is locked when Firefox is running) and cannot be undone.

• Open the Lazarus options dialog (right-click the status bar icon and select "options...")
• Select the "Database" tab
• Click "Delete the Database" button (right down the bottom)
• Click "Ok", Lazarus will delete the database completely and restart Firefox. When Firefox is restarted a new, blank, database will be created.

Manually Deleting Your Lazarus Database

If for some reason you cannot rebuild your database, you may need to manually delete it.

• Locate your Firefox profile folder
• Close all Firefox windows (the database file is locked and cannot be deleted when firefox is running)
• delete the lazarus.sqlite and lazarus-backup.sqlite files
• Restart Firefox. When Firefox is restarted a new, blank, database will be created.

Unresponsive Script Error

In some caase (more often on Linux/Mac machines than Windows) you may get an Unresponsive Script Error when starting Firefox.

We thought we had the problem solved in one of our beta versions but alas this was not the case. The only true solution involves a complete rewrite of Lazarus as the underlying problem is involved with the way we make queries against the Lazarus database. I've begun work on this (Lazarus 3) but it's not ready to take over from the current Firefox version yet.

For now the easiest work around is to delete the database. Sorry :(