My girlfriend's Macbook crashed while attempting to restore from a hibernated file. The progress bar stopped at ~10%, after which we restarted the computer for a normal startup.
This hibernated memory image had an unsaved document open in Pages, which we'd like to recover. There is a
/private/var/vm, which I assume is the hibernate image which never got correctly restored. We backed up this thing to keep it alive.
We tried to
strings sleepimage | grep known_substring but it returned nothing.
grep -a known_substring sleepimage also did nothing, so I'm assuming that Pages didn't keep the text data in memory as plain text.
Edit: After reading this answer on Binary grep I tried to
perl -ln0777e 'print unpack("H*",$1), "\n", pos() while /(null_padded_substring)/g' sleepimage, again being fruitless. I padded it with nulls in order to attempt a match for UTF-8 text. Then I tried with
.* globs between each character –- still no dice.
So Pages probably doesn't store text by any common encoding in memory. I would need to find a translation rule between ASCII string and Pages data representation -- I'm thinking maybe some kind of Objective C string buffer. To me it seems very weird to store character data as anything else than a sequence of characters, but this seems to be what Pages is doing.
If you have any idea on how to figure out the in-memory representation of text inside Pages, it might be very helpful in solving this problem. Maybe I can dump and read the process memory in some simple way?
Another possible solution is simpler -- I'm assuming it is somehow possible to reboot the computer from this
sleepimage, but I can't find any documentation as to how you would proceed with that. Some other users (macrumors) seem to have encountered this, but for all the forum questions I've found, none of them have responses.
The OS X version is Snow Leopard, 10.6.8.
Complex suggestions involving programming are welcome. I do C and Python.