You can also use the debugger on any system where the debugger can attach to a process and make it call system calls. I have done something similar to recover

You can also use the debugger on any system where the debugger can attach to a process and make it call system calls. I have done something similar to recover data that was still available in a process but no longer in any file - an overwritten configuration file. Be careful though - one mistake and you can crash the process, losing the file!