up vote 2 down vote favorite
share [g+] share [fb]

There are some applications that don't write cache files on the disk, instead they write into the RAM directly and thus you can't back it up, analyse it or do anything with it.

How can I retrieve (that is, save to disk) the files they are caching in the RAM ?
I'll take any method: utility, script, Terminal command… (I run OS X 10.6.8)

link|improve this question
Your question is rather vague. Please explain (if possible, with examples) what you are asking for. – Daniel Beck Dec 3 '11 at 20:05
1  
What makes you so sure those "files" exist at all? Why files? – artistoex Dec 3 '11 at 20:28
@artistoex See his comment to my answer. .mov can be streamed though, there is no need for the file to actually be in memory. This question probably cannot be answered. – Daniel Beck Dec 3 '11 at 20:38
feedback

2 Answers

up vote 0 down vote accepted

Open the terminal and type lsof -n which prints all open files. If they are really cache files, they should show up here. Unfortunately, it displays all open files of all processes. If you want to restrict the output to those files opened by the application in question, find out the process id (PID) of the running application and type, e.g. lsof -np 1094 if 1094 were the PID.

link|improve this answer
What's this supposed to do ? (I'm not programmer) – user2534 Dec 3 '11 at 19:54
@user2534 see the sync man page – artistoex Dec 3 '11 at 19:58
I read that, but I'm still not programmer :-) Is it a terminal command ? what is it going to do exactly ? and then what's the next step ? – user2534 Dec 3 '11 at 20:06
@user2534 I've got you wrong. See my edited answer. You don't need to be a programmer, this is just a tool for analysis. – artistoex Dec 3 '11 at 20:07
Ok I did that and I've located what I think are the files I want, in QuickTime's cache. Problem they are in qtch format and as this site says they can't be opened by simply renaming the extension. So now my problem is how to read qtch files. – user2534 Dec 3 '11 at 20:45
show 2 more comments
feedback
up vote 2 down vote

I'm not sure what you're asking for (as programs don't need — and usually just don't — represent the data they're processing in memory the same way they're stored on disk. Data in memory is organized to facilitate processing, data on disk (files) is optimized for interoperability, storage size, or some other reason; and they are transformed from one form to the other when loading or writing files. Even if they are alike, it's probably the other way around: Files are then just memory content written to disk and just as unreadable.

The website to the book Mac OS X Internals provides a description and program on how to dump core of running processes, i.e. write the main memory associated with a particular process to disk.

If you want to compile it on OS X Lion using Apple's developer tools, remove the -arch <name> arguments to gcc from the Makefile.

You can then run sudo ./gcore <pid>, with <pid> as displayed e.g. in Activity Monitor. Open the resulting dump file e.g. in a hex editor to view it. On my system, a rather simple process like Calculator produces files of around 450MB in size.

link|improve this answer
Ok, assuming that I attempt to compile it (never done this before) what will I be able to do with the dump ? what I want to get in the end is what the app got from the server and cached: .mov files – user2534 Dec 3 '11 at 20:18
1  
@user2534 What you're asking for is, generally speaking, just plain impossible without very significant effort. It might be doable for a specific program. Please provide a simple to reproduce test case (what program, what server, what MOV file? Doesn't have to be the one you're actually interested in) we could use to gain some more information. – Daniel Beck Dec 3 '11 at 20:22
What I can tell you is that the app's purpose is to browse and play mov files from a server. The app's developer wrote that files were not written on disk but cached in the RAM, hence my question here. But it appears that they are written in QT's cache. Now I'm trying to play qtch files. – user2534 Dec 3 '11 at 20:49
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.