File Recovery via Core Dump in Debugger?

[honeychurch2]

Ok, this morning, I had two unsaved stickies files open, wanted to close one, and hit cmd+w. A dialog box asked me if I wanted to save my changes, and I clicked don't save. This closed both stickies. Normally I would use Time Machine to recover files, but I hadn't created a backup using Time Machine after I created this file.

I then found a post on the MacResource forums that said this:

Back in the old days of beige Macs with a couple of MB of RAM there was a core-dump procedure in the debugger which extracted the contents of the computer's memory into a file from which you could extract the text of a file you were working on.

It often took a few hours to run.

It turns out that the ability is still there. On modern Macs with a couple of GB or more of RAM, I imagine it would take quite a long time to do the dump.

'Looks like it's supposed to be enabled prior to the event that you want to capture in order to work, but there is a procedure to enable it retroactively.

So my question is, would it be at all possible to enable debugging retroactively, do a core dump, and use the file containing the contents of my computer's memory to retrieve my stickies file? And if so, could some kind person please post a link explaining how, or explain how themselves?

Many thanks!

 

[old-wiz]

I have a hard time believing you could enable debugging retroactively.

 

[honeychurch2]

D'oh. As per the tech note linked in my original post,

You can take a core dump even if you forgot to enable core dumps when you launched your process. The trick is to use GDB to enable core dumps programmatically.

Didn't see that the first time around, and thought there was a way to enable debugging retroactively.

So that doesn't help me then. If I understand correctly, I would have had to start the debugging process before I created my Stickies files, and then once I lost the files, gone back and enabled core dumps?

Sorry if my questions seem a bit ignorant. I consider myself tech-savvy, but this is new territory for me.

 

[honeychurch2]

Just an update that may prove helpful to anyone wanting to recover files from a core dump: I asked a few people more knowledgeable about this stuff than I am, and basically what they said was that it's possible that the contents of the file may be able to be extracted, but only with the program's source code, or its debugging symbols. Neither of which I have, of course. Not to mention that I don't have time to learn how to use GDB, or increase my extremely limited knowledge of Obj-C. While I could look for ASCII strings that represent the lost data, it's really not worth that much trouble.

I hope this info proves useful for someone else, though.